How to secure a Linux server: 10 steps after ordering.

Bots scan the entire internet around the clock for servers with weak passwords and outdated software. The good news: a few basic rules fend off most of these attacks. The commands in this article refer to Debian and Ubuntu but work similarly on any Linux distribution.

1. Update the system immediately

Install all updates right after deployment, because installation images are often a few weeks old:

apt update && apt full-upgrade -y

2. Create your own user instead of working as root

Work with a normal user day to day and only obtain administrator rights when needed via sudo. This prevents costly typos and makes life harder for attackers.

adduser admin
usermod -aG sudo admin

3. SSH keys instead of passwords

Passwords can be guessed, SSH keys practically cannot. Generate a key pair on your own computer and copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id admin@your-server-ip

4. Disable password and root login via SSH

Once key login works, disable password authentication and direct root login. In /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Then reload the service (systemctl reload ssh) – and always test in a second session before closing the first. For emergencies, the KVM console in our customer panel remains available.

5. Enable a firewall

Only allow the ports you really need – for example SSH plus HTTP and HTTPS for a web server:

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

6. Fail2ban against brute-force attacks

Fail2ban automatically blocks IP addresses that repeatedly try to log in with wrong credentials. The default configuration already protects SSH after installation (apt install fail2ban).

7. Install security updates automatically

With unattended-upgrades your server installs security updates on its own, so critical vulnerabilities don't stay open just because nobody thought of it during the holidays:

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

8. Only run the services you need

Every running service is a potential attack surface. Use ss -tulpn to check which programs are listening for network connections and disable anything you don't need. Databases such as MySQL or PostgreSQL should usually only be reachable locally.

9. Backups – stored off the server

A backup on the same server doesn't help if the server fails or gets encrypted. Back up regularly to another system – ideally at a different location – and test the restore. With us, backups can be booked as an add-on.

10. Set up monitoring

You should know when your server is unreachable, the disk is filling up or load is unusually high – before your customers notice. Even a simple external availability check is better than nothing.

No time for server administration?

We are happy to take care of all these steps – and the ongoing maintenance afterwards. With a managed VPS or managed dedicated server we handle updates, hardening, backups and monitoring. Our support is available around the clock. Which option suits you is explained in our guide Managed or unmanaged server?

FAQ