Server Security Glossary

An A to Z index of the terms that come up most often when hardening a Linux server. Pick a term to open its full definition.

A

• Application-layer attack (Layer 7)A DDoS attack that targets the web application itself with requests that look legitimate, making it harder to distinguish from real traffic than a simple flood..
• authorized_keysThe file listing which public keys are allowed to log in to a given account over SSH.

B

• Brute-force attackAutomatically trying many username and password combinations against a login service until one works.

C

• ContainmentThe incident response step focused on stopping an active breach from spreading further, before trying to fully remove its underlying cause..

D

• DDoS attackDistributed Denial of Service: an attempt to make a server or service unavailable by overwhelming it with traffic from many sources at once, rather than trying to break in..
• Default deny policyA firewall configuration that blocks all traffic by default and only allows specific, explicitly listed connections through.
• DIY securityHandling all server hardening, monitoring and incident response internally with existing staff and time, rather than paying for a managed service..

F

• fail2banA widely used intrusion-prevention tool that watches log files for patterns like repeated failed logins and temporarily or permanently bans the source IP address using the server's firewall..
• File integrity monitoringContinuously checking whether files that should not change, such as system binaries or configuration files, have actually been modified..
• FirewallSoftware or hardware that controls which network traffic is allowed to reach a server, based on rules such as IP address and port.

I

• Incident responseThe structured process of detecting, containing, eradicating and recovering from a security incident, followed by a review of what allowed it to happen in the first place..
• Intrusion preventionSoftware that automatically detects and blocks malicious behavior, such as fail2ban banning an IP after repeated failed logins, rather than only logging it for a human to review later..
• iptablesThe original Linux firewall tool, built on the kernel's netfilter framework.

J

• Jail (fail2ban)A specific monitoring rule set inside fail2ban targeting one service, such as an sshd jail or an nginx-http-auth jail, each with its own ban conditions..

K

• Kernel live patchingApplying security fixes to a running Linux kernel without rebooting the server, useful when scheduled downtime is difficult to arrange..
• Key-based authenticationLogging in to SSH with a cryptographic key pair instead of a password.

M

• Managed securityA service where a third party continuously monitors, maintains and responds to security events on a server, instead of a business handling all of it in-house..

N

• N-day exploitAn attack against a vulnerability that is already publicly known and already has a patch available.
• nftablesThe modern replacement for iptables on Linux, part of the same netfilter framework but with cleaner syntax and better performance at scale..
• nginxA widely used web server and reverse proxy.

P

• Patch managementThe ongoing process of tracking, testing and applying software updates that fix known security vulnerabilities, rather than updating only when something breaks..
• Patch windowA predefined, agreed time period during which updates are tested and applied to production servers, used to avoid surprise changes at unpredictable times..
• Protocol attackA DDoS attack that exploits weaknesses in network protocols themselves, exhausting server or network equipment resources rather than raw bandwidth..

R

• Rate limitingRestricting how many requests or connection attempts a single source can make within a given time window, used to slow down brute-force and scraping attempts without blocking legitimate users outright..
• Read-only auditA security scan that only inspects a system's current state without changing any configuration, banning IPs, or deleting anything, used to establish a baseline before any other action is taken..
• RECOVERED vs VERIFIEDA distinction where a service responding normally again after an incident is only "recovered," while "verified" additionally requires independent checks of files, services and network state to confirm the incident's actual cause was addressed..
• Root loginLogging in directly as the root, or administrator, account over SSH.

S

• Security headersHTTP response headers such as Strict-Transport-Security or X-Content-Type-Options that instruct browsers to enforce additional protections on top of whatever the server itself does..
• server_tokensAn nginx setting that, when left on, exposes the exact nginx version number in every response, giving attackers a head start on finding version-specific vulnerabilities..
• SIEMSecurity Information and Event Management: a system that centralizes and correlates log data from multiple sources, making it possible to spot patterns that would be invisible looking at any single log file alone..
• SSHSecure Shell, the encrypted protocol used to remotely log in to and administer a Linux server.
• sshd_configThe main configuration file for the SSH daemon on Linux, usually located at /etc/ssh/sshd_config.

T

• TLS / SSLThe cryptographic protocols that encrypt traffic between a browser and a server.

U

• ufw (Uncomplicated Firewall)A simplified frontend for iptables aimed at making common firewall rules easy to write correctly.
• UID 0Any Linux account with user ID 0 has exactly the same privileges as root, regardless of its username.
• unattended-upgradesA Debian and Ubuntu package that automatically installs security updates on a schedule, without requiring someone to log in and run the update manually..

V

• Volumetric attackA DDoS attack that simply floods a target with more traffic than its network connection can handle..
• VPS (Virtual Private Server)A virtual machine rented from a hosting provider that gives full administrative control over the operating system, meaning all security configuration is the renter's own responsibility from day one..

W

• WAF (Web Application Firewall)A layer that inspects HTTP requests for attack patterns like SQL injection before they reach the application itself, complementing rather than replacing server hardening..

Z

• Zero-day exploitAn attack that uses a vulnerability the software vendor does not yet know about, so no patch exists yet.