2026-09-07

5 quick server hardening basics

Before anything more advanced, these five checks catch most of what actually gets a Linux server compromised. None of them take long, and they're a reasonable starting point whether or not you use a managed service.

1. SSH: key-based auth only. Disable password login (PasswordAuthentication no in sshd_config) so brute-forcing a password stops being an option.
2. Disable root login over SSH. Use a named user with sudo instead — it also means every login is attributable.
3. Keep packages patched. Unattended security updates (or a regular patch window) close known vulnerabilities before they're exploited automatically at scale.
4. Only expose the ports you actually use. A default-deny firewall with explicit allow rules is far easier to reason about than trying to remember what's listening.
5. Actually look at your logs. Auth failures, unexpected outbound connections and new listening ports are usually visible well before anything is lost — if something is watching for them.

Why this matters

Most compromises we see start with one of these five being skipped, not with anything exotic. Hardening buys time and visibility; it doesn't replace having something that actually reacts when one of these checks would have failed anyway.