secure Linux server

How to Secure Your Linux Server in 10 Steps

by

Setting up a Linux server is just the beginning. Without proper security measures, your server is vulnerable to hackers, brute force attacks, and malware. In 2026, cybersecurity threats are more sophisticated than ever — making server security a top priority for every developer and system administrator.

In this guide, we’ll walk you through 10 essential steps to secure your Linux server — whether you’re running Ubuntu, Debian, or CentOS.

Step 1 — Update Your System Regularly

The first and most important step is keeping your system up to date. Security patches are released regularly, and failing to update leaves known vulnerabilities open to attackers.

bash

sudo apt update && sudo apt upgrade -y

Enable automatic security updates:

bash

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades

Step 2 — Create a Non-Root User

Never use the root account for daily server management. Create a regular user with sudo privileges instead:

bash

# Create new user
sudo adduser yourname

# Add to sudo group
sudo usermod -aG sudo yourname

Switch to the new user:

bash

su - yourname

Step 3 — Harden SSH Configuration

SSH is the most common attack vector for Linux servers. Hardening your SSH configuration is critical.

Edit the SSH config file:

bash

sudo nano /etc/ssh/sshd_config

Change these settings:

bash

# Disable root login
PermitRootLogin no

# Change default SSH port (use any number between 1024-65535)
Port 2222

# Disable password authentication (use SSH keys instead)
PasswordAuthentication no

# Limit login attempts
MaxAuthTries 3

# Set login timeout
LoginGraceTime 30

Restart SSH:

bash

sudo systemctl restart sshd

Step 4 — Set Up SSH Key Authentication

SSH keys are much more secure than passwords. Generate an SSH key pair on your local machine:

bash

ssh-keygen -t ed25519 -C "your@email.com"

Copy your public key to the server:

bash

ssh-copy-id -i ~/.ssh/id_ed25519.pub yourname@your-server-ip

Now you can login without a password — and since we disabled password auth, only key holders can access the server.

Step 5 — Configure UFW Firewall

UFW (Uncomplicated Firewall) makes it easy to manage firewall rules on Ubuntu and Debian.

bash

# Install UFW
sudo apt install ufw -y

# Set default rules
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (use your custom port if you changed it)
sudo ufw allow 2222/tcp

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status verbose

Step 6 — Install Fail2Ban

Fail2Ban automatically bans IP addresses that make too many failed login attempts — protecting your server from brute force attacks.

bash

# Install Fail2Ban
sudo apt install fail2ban -y

# Start and enable
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Create a local configuration:

bash

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Set these values:

bash

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600

Restart Fail2Ban:

bash

sudo systemctl restart fail2ban

Step 7 — Disable Unused Services

Every running service is a potential attack surface. Disable services you don’t need:

bash

# List all running services
sudo systemctl list-units --type=service --state=running

# Disable a service
sudo systemctl disable servicename
sudo systemctl stop servicename

Common services to disable if not needed:

  • bluetooth
  • cups (printing)
  • avahi-daemon (network discovery)

Step 8 — Set Up Automatic Security Auditing with Lynis

Lynis is a free security auditing tool that scans your system and suggests improvements:

bash

# Install Lynis
sudo apt install lynis -y

# Run a security audit
sudo lynis audit system

Lynis will give your system a hardening index score and list specific recommendations to improve security.

Step 9 — Monitor System Logs

Regularly monitoring logs helps you detect suspicious activity early:

bash

# Check authentication logs
sudo tail -f /var/log/auth.log

# Check system logs
sudo journalctl -xe

# Check failed login attempts
sudo grep "Failed password" /var/log/auth.log

Install Logwatch for daily log summaries:

bash

sudo apt install logwatch -y
sudo logwatch --detail high --mailto your@email.com --range today

Step 10 — Enable Two-Factor Authentication (2FA)

Add an extra layer of security with 2FA for SSH login:

bash

# Install Google Authenticator
sudo apt install libpam-google-authenticator -y

# Set up 2FA for your user
google-authenticator

Follow the prompts to set up 2FA with your phone’s authenticator app.

Then edit the PAM configuration:

bash

sudo nano /etc/pam.d/sshd

Add this line at the top:

auth required pam_google_authenticator.so

Security Checklist

Here’s a quick checklist to verify your server is secured:

  • ✅ System updated and auto-updates enabled
  • ✅ Non-root user created with sudo access
  • ✅ SSH root login disabled
  • ✅ SSH port changed from default 22
  • ✅ Password authentication disabled
  • ✅ SSH key authentication set up
  • ✅ UFW firewall configured and enabled
  • ✅ Fail2Ban installed and running
  • ✅ Unused services disabled
  • ✅ Logs monitored regularly

Final Thoughts

Securing your Linux server doesn’t have to be complicated. By following these 10 steps, you’ll significantly reduce the risk of your server being compromised.

Remember — security is not a one-time task. Keep your system updated, monitor your logs regularly, and stay informed about new vulnerabilities.

Which security step do you think is most important? Share your thoughts in the comments! 👇

Found this guide helpful? Check out our Linux & Ubuntu and Cybersecurity categories for more tutorials!

Leave a Comment