Linux Server Security: A Step-by-Step Checklist

1. Keep the system up to date

When you first connect to the server, update all packages:

sudo apt update && sudo apt upgrade

Then make sure security updates are installed automatically:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

By default, unattended-upgrades only installs security updates. Kernel updates don't take effect until the server is restarted; if the /var/run/reboot-required file exists, restart at a convenient time. On AlmaLinux and Rocky Linux, the dnf-automatic package does the same job.

2. A regular user and an SSH key

Instead of working as root all the time, create a user with sudo rights, set up SSH key login, and then turn off password login and root login:

PasswordAuthentication no
PermitRootLogin no

Before making these changes in the /etc/ssh/sshd_config file, always test in a separate terminal that you can connect with the new user and your key. We cover all the steps in detail in our What is SSH? article.

3. Firewall

Block everything incoming by default and open only the ports you actually use:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable

Don't forget to add the OpenSSH rule before the enable command; otherwise you'll lock yourself out. Never expose services such as databases and admin panels to the internet; use an SSH tunnel or WireGuard for remote access. If you use Docker, remember that published ports bypass ufw rules; the details are in our What is a port? and How to install Docker articles.

4. Fail2ban

Fail2ban automatically blocks IP addresses that make repeated failed login attempts for a while. SSH key login already provides the main protection, but Fail2ban reduces the noise in the logs and also protects other services such as Nginx. We cover the setup in our How to install Fail2ban guide.

5. Turn off unneeded services

Every service on the server that listens to the outside is a door. See what's listening:

sudo ss -tulpn

If you see a service you don't recognize or don't use, stop it and keep it from starting at boot:

sudo systemctl disable --now service-name

Removing packages you don't use also shrinks the attack surface.

6. Run applications as separate users

Run web applications, bots and game servers as a separate user for each one instead of root. This way, a vulnerability in one application can only reach that user's files. Be careful with file permissions too: settings that give everyone write access, like chmod 777, may look like they solve problems, but they're a serious security hole. We cover permissions in our Basic Linux commands guide.

7. Protect secrets

• Write passwords, API keys and database credentials in files like .env instead of in the code, and don't add these files to the Git repository.
• Make sure secret files can only be read by the user they belong to (chmod 600).
• Use a separate password and key for each service and person; when something leaks, you only need to change that one.

We cover managing secrets during deployment in our How to deploy with Git guide.

8. Backups

Security measures may not be enough one day; on that day, a backup is what saves you. Take backups following the 3-2-1 rule, keep at least one copy encrypted and somewhere independent of the server, and test restoring regularly. The details are in our Server backups guide.

9. Monitoring and auditing

• Login records: last shows recent logins, and sudo journalctl -u ssh shows the SSH logs. If you see a successful login from an IP address you don't recognize, act immediately.
• Resource usage: A process you don't recognize that constantly uses CPU can be a sign of a compromised server. We explain how to check this in our Why is my server slow? article.
• Security audit: The open-source Lynis tool scans your server against hundreds of checkpoints and makes recommendations:

  sudo apt install lynis
  sudo lynis audit system
  

• Availability: Track whether your server is up with a monitoring service; take a look at our What is uptime? article.

10. Protect your account too

The account you manage your server with matters as much as the server itself. Turn on two-factor authentication in your provider's client area and use a unique password for each service. Someone with access to the panel can reinstall your server, reach your backups or reset passwords.

Security at Nodesty

With full root access on Nodesty AMD Ryzen 9 9950X VPS and AMD EPYC 7763 VPS plans, you can apply every step in this checklist. L3–L7 nShield DDoS protection filters network-level attacks before they reach your server, free daily backups kept for 7 days form your last safety net, and when your SSH access is cut off, you can always reach your server through the web console. You can also protect your account by turning on two-factor authentication in your client area.