Security is not a destination, it's a continuous process

In my experience as a system administrator, I've seen too many times how companies trust that a newly installed Linux server is secure by default. Nothing could be further from the truth. Hardening and periodic maintenance are two sides of the same coin: without a hardened base, any subsequent patch is a patch on sand; without maintenance, even the most robust system degrades until it becomes a sieve. This article is a practical guide based on my field experience, with concrete steps and mistakes you should avoid.

First steps: minimize the attack surface

The first principle of hardening is simple: if you don't need it, remove it. This applies to services, packages, users, and ports. Before touching anything, perform a complete inventory of the system: what services are listening, what ports are open, and what packages are installed. Tools like ss -tulpn, netstat, or local nmap will give you a clear picture.

Disable unnecessary services

On many distributions, services like cups, avahi-daemon, or bluetooth come enabled without anyone using them. Disable them with systemctl disable --now. Each disabled service is one less door for an attacker.

Configure the firewall from day one

Don't wait until you have an incident to configure iptables or nftables. A default policy of denying all incoming traffic and allowing only what's necessary (SSH, HTTP/HTTPS, etc.) is the foundation of any secure server. Also remember to filter outgoing traffic to prevent data exfiltration.

Authentication and access: your first line of defense

Access to the server is the most critical point. There are no excuses here: password authentication must be eliminated or, at least, complemented with SSH keys and two-factor authentication. In my opinion, using passwords for SSH is an unnecessary risk in production environments.

• Disable root access via SSH: edit /etc/ssh/sshd_config and set PermitRootLogin no. Use a user with sudo privileges.
• Implement SSH keys: generate a key pair with ssh-keygen and copy the public key to the server. Disable password authentication (PasswordAuthentication no).
• Use fail2ban: this tool blocks IPs after several failed attempts. It's easy to configure and very effective.
• Change the SSH port (optional): although it's not security through obscurity, changing port 22 to another reduces noise from automated scans.

Kernel and service hardening

The Linux kernel offers a series of parameters that can harden the system. For example, enable sysctl to protect against certain attacks:

• net.ipv4.tcp_syncookies = 1 to mitigate SYN floods.
• net.ipv4.conf.all.rp_filter = 1 to enable reverse path filtering.
• kernel.randomize_va_space = 2 for address space layout randomization (ASLR).

Additionally, for web services like Nginx or Apache, apply HTTP security headers (HSTS, X-Frame-Options, CSP) and disable directory listing. If you use databases, run them with a user without privileges and on an isolated network.

Maintenance: the routine that saves you

Hardening is not a one-time event; it's a cycle. Regular maintenance includes:

• Security updates: configure automatic updates for critical patches, but always test in a staging environment before applying to production.
• Log monitoring: centralize logs with tools like ELK or Loki. Regularly review them for anomalous patterns.
• Periodic backups: automate backups and, most importantly, test restoration. A backup that hasn't been tested is not a backup.
• Security audits: run tools like Lynis or OpenSCAP to assess the hardening level and detect deviations.

The human factor and vulnerability management

No matter how hardened your server is, if vulnerability management is deficient. As I mentioned in my article on AI-powered vulnerability scanning, automation is key to staying up to date. Establish a process to track CVEs related to your stack and prioritize based on real exposure.

Conclusion: a continuous security mindset

Hardening and maintenance of Linux servers are not tasks that are done once and forgotten. They require constant discipline and a curiosity to learn from each incident. At ForgeNEX, in our Computer Security category, we promote this culture. Remember: security is a process, not a product. Start with the basics, automate the repetitive, and never underestimate the value of good documentation.