Skip to main content

Secure a new Linux server

A new server is reachable from the internet as soon as it starts, and automated scanners begin trying to sign in within minutes. This checklist covers the steps to take in the first hour on a new Linux VPS or cloud server, before you install websites or apps. Commands are given for Debian and Ubuntu (which use apt) and for AlmaLinux, Fedora and CentOS Stream (which use dnf).

1. Update all packages​

Start by installing every available update, since the image may be older than the latest security fixes.

# Debian and Ubuntu
apt update && apt upgrade -y

# AlmaLinux, Fedora and CentOS Stream
dnf upgrade -y

Restart the server if the update included a new kernel: reboot.

2. Create a user with sudo rights​

Working as root all the time makes mistakes costly and gives attackers a known username to target. Create your own user and give it sudo rights, which let it run administrator commands when needed by typing sudo in front.

# Debian and Ubuntu
adduser jane
usermod -aG sudo jane

# AlmaLinux, Fedora and CentOS Stream
useradd -m jane
passwd jane
usermod -aG wheel jane

Then give the new user your SSH key. If the key is already set up for root, copy it across:

mkdir -p /home/jane/.ssh
cp /root/.ssh/authorized_keys /home/jane/.ssh/
chown -R jane:jane /home/jane/.ssh
chmod 700 /home/jane/.ssh
chmod 600 /home/jane/.ssh/authorized_keys

Open a new terminal and check that ssh jane@203.0.113.40 works and that sudo whoami answers root.

3. Allow SSH keys only​

Passwords can be guessed; keys practically cannot. Once your key sign-in works for the new user, turn off password sign-in and direct root sign-in.

  1. Open the SSH server's configuration file: sudo nano /etc/ssh/sshd_config.

  2. Set these lines, removing any # in front of them:

    PermitRootLogin no
    PasswordAuthentication no

  3. Check the folder /etc/ssh/sshd_config.d/ for files that set PasswordAuthentication or PermitRootLogin too. Settings there can take priority over the main file, so change them there as well.

  4. Test the configuration with sudo sshd -t. No output means no errors.

  5. Restart SSH: sudo systemctl restart ssh on Debian and Ubuntu, or sudo systemctl restart sshd on AlmaLinux, Fedora and CentOS Stream.

  6. Keep your current session open and connect from a second terminal. Only close the first session once the new connection works.

Don't lock yourself out

If the second connection fails, use the session that is still open to undo the change. If you lose access completely, use your provider's browser-based console, if available, to fix the file.

4. Turn on a firewall​

A firewall decides which network ports accept connections. Allow only what you need: SSH, and web ports 80 (HTTP) and 443 (HTTPS) if the server hosts websites.

On Debian and Ubuntu, ufw is the usual tool. Allow SSH before enabling it:

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

On AlmaLinux, Fedora and CentOS Stream, firewalld is the usual tool:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

If you changed the SSH port, allow that port instead of the default service. Some providers also offer a network firewall in front of the server; keep both sets of rules consistent.

5. Install security updates automatically​

New security fixes appear all the time. Automatic updates install them without waiting for you.

# Debian and Ubuntu
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

On AlmaLinux and CentOS Stream, install dnf-automatic, set apply_updates = yes in /etc/dnf/automatic.conf, and start its timer:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

The configuration file and timer names can differ between releases, especially on recent Fedora versions, so check your distribution's documentation if these commands do not match. Some updates, such as a new kernel, still need a restart to take effect.

6. Optional: block repeated sign-in attempts​

fail2ban watches log files and temporarily blocks addresses that fail to sign in many times. With key-only SSH it is not essential, but it reduces log noise and can protect other services, such as mail or web logins. It is available in the standard package repositories of Debian and Ubuntu and, on AlmaLinux and CentOS Stream, through the EPEL repository.

7. Plan backups and monitoring​

  • Backups: set up off-server backups and take a snapshot now that the base system is ready, see Snapshots and server backups.
  • Monitoring: keep an eye on CPU, memory, disk space and whether the server is reachable, and set alerts so you hear about problems before visitors do. Check disk space regularly with df -h.
  • Routine: review sign-in logs, remove software you no longer use, and repeat these checks after major changes.
At DomainPilot

DomainPilot VPS is self-managed: DomainPilot looks after the hardware, network and virtualization, and you manage the operating system and apps, including the steps in this guide. VPS plans include snapshots, monitoring graphs and alerts, and network DDoS protection. Cloud servers include snapshots and firewalls.

Did this article help you?