There is no exciting secret to hardening a Linux server. That is the good news, and also the part most people skip. The servers I have seen get into trouble were rarely beaten by some brilliant new attack. They were beaten by the basics that had been put off: an old package, a password that should never have been allowed, a port left open because nobody remembered why.<\/p>\n\n
I like boring security because boring security is repeatable. I can do it on a tired afternoon, I can check it later, and I can explain it to someone else without a diagram. If a security step only works when I am feeling clever, it is not really a security step. It is a hope.<\/p>\n\n
Start with updates. Timely updates are not glamorous, but they close known holes before they become someone else’s easy entry point. I keep a regular routine for checking and applying them, and I pay attention to services that need a restart after an update. An update that was downloaded but never applied does not protect anything.<\/p>\n\n
Next, stop using passwords for SSH if you can avoid it. Keys are harder to guess, harder to spray across thousands of servers, and easier to revoke when someone leaves or a laptop is lost. I disable password login for SSH, keep keys protected, and treat access like something to hand out carefully, not something to share around for convenience.<\/p>\n\n
A firewall is the next unglamorous layer. Only the ports that need to be reachable should be reachable. Everything else stays closed. That sounds obvious, yet I still find servers where a database or an admin panel is listening to the whole internet because it was convenient during setup and nobody went back to close it. Convenience during setup becomes risk for the life of the server.<\/p>\n\n
Fail2ban earns its place for the same reason. It does not make a server invincible, but it raises the cost of the constant background knocking that every public server receives. Combined with key-only SSH, it turns a noisy, automated guessing game into something much less rewarding for the attacker.<\/p>\n\n
Least privilege ties all of this together. Services should run with only the access they need. Users should have only the permissions their job requires. When something does go wrong, and eventually something will, a tight permission set limits how far the problem can spread. I would rather spend an extra minute setting a permission correctly than spend a weekend cleaning up after a service that could read and write everything.<\/p>\n\n
None of this is a one-time job. Hardening is a habit: check the basics, remove what is no longer needed, review who has access, and keep notes so the next version of you does not have to guess. The practical takeaway is simple and dull, which is exactly why it works: update promptly, use keys, close the ports you do not need, let fail2ban do its quiet work, and give nothing more permission than it needs.<\/p>\n\n
One more boring habit belongs on the list: know how you would recover. Backups, a tested restore, and a note about how the server is put together turn a bad day into a repair job instead of a rebuild from memory. Security is not only about keeping people out. It is about being able to put things right, calmly, when something slips through.<\/p>","protected":false},"excerpt":{"rendered":"
There is no exciting secret to hardening a Linux server. That is the good news, and also the part most people skip. The servers I have seen get into trouble were rarely beaten by some brilliant new attack. They were beaten by the basics that had been put off: an old package, a password that […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-36","post","type-post","status-publish","format-standard","hentry","category-technical-commentary"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":1,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/36\/revisions"}],"predecessor-version":[{"id":37,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/36\/revisions\/37"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=36"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=36"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}