How to secure a new Linux server in the first hour

The commands below assume a user with sudo rights; if you are still logged in as root, leave out sudo. Start with a fully patched system. On Ubuntu and Debian:

sudo apt update
sudo apt full-upgrade

On AlmaLinux, Rocky Linux and other RHEL-family systems, run sudo dnf upgrade. Reboot if the kernel was updated.

Working as root makes every typing mistake a system-wide risk. Create your own user and give it administrator rights:

adduser alex
usermod -aG sudo alex

On RHEL-family systems the administrator group is wheel: create the user with useradd -m alex, set a password with passwd alex and run usermod -aG wheel alex.

On your own computer, create a key pair and copy the public key to the new user. The private key stays on your computer; protect it with a passphrase.

ssh-keygen -t ed25519
ssh-copy-id [email protected]

Open a new terminal and confirm that ssh [email protected] logs you in with the key before you change anything else.

Put your SSH settings in a file of their own. OpenSSH uses the first value it reads for each option, and current Ubuntu, Debian and RHEL-family releases read the files in /etc/ssh/sshd_config.d/ before the rest of the main configuration, so a file whose name sorts first takes effect:

sudo nano /etc/ssh/sshd_config.d/00-hardening.conf

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Check the syntax with sudo sshd -t and list the settings that are really in effect with sudo sshd -T. Then restart the service: sudo systemctl restart ssh on Ubuntu and Debian, sudo systemctl restart sshd on RHEL-family systems. Keep your current session open and test a new login in a second terminal, so that a mistake cannot lock you out.

Allow SSH first and then switch the firewall on, so that you do not cut your own connection. On Ubuntu, UFW is installed by default; on Debian, install it with sudo apt install ufw.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

On RHEL-family systems firewalld is the usual tool, and SSH is allowed in its default zone: open a service with sudo firewall-cmd --permanent --add-service=https and apply it with sudo firewall-cmd --reload. Open only the ports of services you actually run. Moving SSH to another port reduces log noise, but it is not protection on its own; keys and a firewall are.

Ubuntu installs unattended-upgrades by default and applies security updates automatically; confirm that it is enabled with sudo dpkg-reconfigure -plow unattended-upgrades. On Debian, install the same package first. On RHEL-family systems, install dnf-automatic, set apply_updates = yes in /etc/dnf/automatic.conf and enable it with sudo systemctl enable --now dnf-automatic.timer. Some updates, such as a new kernel, take effect only after a reboot, so plan a regular maintenance window.

Keep the clock correct, because logs, certificates and two-factor codes depend on it: timedatectl shows whether time synchronisation is active. List the services that listen on the network with sudo ss -tulpn and disable those you do not need. To slow down password guessing against services that still accept passwords, a tool such as Fail2ban can block addresses that fail repeatedly.

A backup is proven only once you have restored it. Follow the 3-2-1 idea: three copies of your data, on two different kinds of storage, with one copy away from the server. Take a snapshot before risky changes where your plan offers snapshots, schedule regular database dumps and file backups to another location, and restore one to a test system to check that it works.