Server Security Hardening: Comprehensive Checklist

When you set up a new Linux server, the default configuration is not security-optimized. Server hardening involves systematic configuration changes to reduce the attack surface and close security vulnerabilities. This guide provides a comprehensive security checklist for your REXE servers.

Why Server Hardening?

Default Linux installations may have:

Unnecessary services running
SSH open to password authentication
Root login enabled
Minimal firewall rules
Automatic updates disabled

Don't close your existing SSH connection while hardening. After each step, test the connection from a new terminal.

✅ Checklist 1: System Updates

hljs bash

# Update the system
sudo apt update && sudo apt upgrade -y

# Install automatic security updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Check configuration
cat /etc/apt/apt.conf.d/50unattended-upgrades

# /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";

✅ Checklist 2: SSH Hardening

hljs bash

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# SSH Security Settings

# Disable root login
PermitRootLogin no

# Disable password authentication (after SSH key is set up)
PasswordAuthentication no

# Disallow empty passwords
PermitEmptyPasswords no

# Disable X11 forwarding
X11Forwarding no

# Maximum login attempts
MaxAuthTries 3

# Maximum concurrent sessions
MaxSessions 5

# Login timeout (seconds)
LoginGraceTime 30

# Protocol version
Protocol 2

# Allow specific users only
AllowUsers admin deploy

# Change SSH port (optional)
# Port 2222

# Strong encryption algorithms
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256

hljs bash

# Test SSH configuration
sudo sshd -t

# Restart SSH service
sudo systemctl restart sshd

✅ Checklist 3: Firewall Configuration

hljs bash

# Install and configure UFW
sudo apt install ufw -y

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH first!
sudo ufw allow ssh
# Or for custom port:
# sudo ufw allow 2222/tcp

# Web services
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow access from specific IP
sudo ufw allow from 192.168.1.0/24 to any port 3306

# Enable UFW
sudo ufw enable

# Check status
sudo ufw status verbose

Advanced UFW Rules

hljs bash

# Rate limiting for brute force protection
sudo ufw limit ssh

# Block specific IP
sudo ufw deny from 1.2.3.4

# Delete a rule
sudo ufw delete allow 80/tcp

# Show rules numbered
sudo ufw status numbered

# Delete rule by number
sudo ufw delete 3

✅ Checklist 4: Fail2Ban Setup

Fail2Ban monitors failed login attempts and automatically blocks repeated attacks.

hljs bash

# Install Fail2Ban
sudo apt install fail2ban -y

# Create local configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

hljs ini

# /etc/fail2ban/jail.local

[DEFAULT]
# Ban duration (seconds)
bantime = 3600

# Detection window (seconds)
findtime = 600

# Maximum failed attempts
maxretry = 5

# Email notification
destemail = admin@example.com
sender = fail2ban@example.com
mta = sendmail

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400

[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

[nginx-limit-req]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 10

hljs bash

# Start Fail2Ban
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# Check status
sudo fail2ban-client status
sudo fail2ban-client status sshd

# View banned IPs
sudo fail2ban-client status sshd | grep "Banned IP"

# Unban an IP
sudo fail2ban-client set sshd unbanip 1.2.3.4

✅ Checklist 5: Disable Unnecessary Services

hljs bash

# List running services
sudo systemctl list-units --type=service --state=running

# Disable unnecessary services
sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now cups
sudo systemctl disable --now bluetooth
sudo systemctl disable --now rpcbind

# Check open ports
sudo ss -tlnp
sudo netstat -tlnp

# Find which service uses which port
sudo lsof -i :80

✅ Checklist 6: File System Security

hljs bash

# Find SUID/SGID files
find / -perm /4000 -type f 2>/dev/null
find / -perm /2000 -type f 2>/dev/null

# Find world-writable files
find / -perm -0002 -type f 2>/dev/null

# Find files with no owner
find / -nouser -o -nogroup 2>/dev/null

# Secure /tmp mount
# Add to /etc/fstab:
# tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0

# Make critical files immutable
sudo chattr +i /etc/passwd
sudo chattr +i /etc/shadow
sudo chattr +i /etc/gshadow

# Remove immutable attribute
sudo chattr -i /etc/passwd

✅ Checklist 7: Kernel Security Parameters

hljs bash

# Edit sysctl configuration
sudo nano /etc/sysctl.d/99-security.conf

# Network security
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1

# IPv6 redirects
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Memory protection
kernel.randomize_va_space = 2
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2

# Disable core dumps
fs.suid_dumpable = 0

hljs bash

# Apply changes
sudo sysctl -p /etc/sysctl.d/99-security.conf

✅ Checklist 8: Log Monitoring

hljs bash

# Important log files
tail -f /var/log/auth.log      # Authentication
tail -f /var/log/syslog        # System logs
tail -f /var/log/fail2ban.log  # Fail2Ban
tail -f /var/log/ufw.log       # Firewall

# Count failed SSH logins
grep "Failed password" /var/log/auth.log | wc -l

# Recent successful logins
grep "Accepted" /var/log/auth.log | tail -20

# Install Logwatch (daily summary)
sudo apt install logwatch -y
sudo logwatch --output stdout --format text --range today

✅ Checklist 9: User Account Security

hljs bash

# Find accounts with empty passwords
awk -F: '($2 == "") {print}' /etc/shadow

# Configure password policy
sudo apt install libpam-pwquality -y
sudo nano /etc/security/pwquality.conf

# Password quality requirements
minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
minclass = 3

✅ Checklist 10: Security Scanning

hljs bash

# Security audit with Lynis
sudo apt install lynis -y
sudo lynis audit system

# Rootkit scan with rkhunter
sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --check

# Virus scan with ClamAV
sudo apt install clamav -y
sudo freshclam
sudo clamscan -r /home

Lynis security score should be 70+. A lower score indicates areas needing improvement. Run it regularly (monthly).

Quick Reference Checklist

Conclusion

Server hardening is not a one-time task but an ongoing process. Apply this checklist to new server setups and conduct regular security audits. These steps will significantly improve the security of your REXE servers.

Server Security Hardening: Comprehensive Checklist

Table of Contents