Basic steps to secure a Linux server

secure-linux-server.md

Basic steps to secure a Linux server

Intro

Just got a new Linux based server or have an existing one and want to secure it? Follow these steps!

These steps are from Alexzander's wonderful YouTube video (<8 min), which you should watch for full context. He goes into the details of what each command does and why you want to do it.

I will call out steps that I added (i.e. steps that were not covered in the video) with a ➕.

Steps

Update all packages

• apt update && apt upgrade -y

Install fail2ban

• apt install fail2ban -y
• systemctl enable fail2ban
• systemctl start fail2ban

Configure firewall

• ufw default deny incoming
• ufw default allow outgoing
• OPTIONAL ufw default allow forward
  • This is useful for when you're going to be hosting something like a VPN (e.g. Wireguard)
  • ➕ This is my own addition (not from the video)
• ufw allow ssh
  • Any other ports you need: ufw allow PORT_NUMBER (replace PORT_NUMBER with the necessary port number)
• ufw enable

Disable root login

• add user USER_NAME (replace USER_NAME with your own username)
  • Skip this if you already have another user
• nano /etc/ssh/sshd_config
  • Set PermitRootLogin no and save
• systemctl restart sshd
• Once logged in as non-root user, use sudo su to switch to root user
  • In the video, su root was shown, but didn't work for me on Ubuntu 22/24.

SSH Key Login

• On your local machine, run ssh-keygen -b 4096 to create a public/private key pair
  • ➕ This is different than the video, where Alex used Bitvise to create his key
  • You can skip this step if you already have a SSH key on your local computer
    • Usual Windows location: %userprofile%/.ssh/id_rsa.pub
    • Usual Mac location: ~/.ssh/id_rsa.pub
• On the server, go to your home directory /home/USER_NAME
  • If you don't have a .ssh folder make one: mkdir .ssh
  • cd .ssh
  • nano authorized_keys
    • Paste in your public key from above and save the file
  • systemctl restart sshd

Disable password login

• nano /etc/ssh/sshd_config
  • Set PasswordAuthentication no and save
• systemctl restart sshd