Hardening
Security checklist
Server Hardening Checklist
Track your Linux server security hardening progress.
How to use the Hardening tool
Server hardening is the process of reducing attack surface by locking down configuration: disabling root login, enforcing SSH keys, adding fail2ban, enabling a firewall, and keeping software patched. This interactive checklist walks you through the essential measures for a Linux server. Check items as you complete them, and your progress is saved locally in your browser.
- 1 Work through the checklist item by item on your server.
- 2 Tick each box once the measure is actually configured and verified.
- 3 Watch the progress bar update — your progress is saved locally in your browser.
- 4 Revisit the checklist after major OS upgrades or new services.
Example: Getting started
Top items to tackle first:
1. SSH key authentication only (disable password login) 2. Fail2ban intrusion prevention 3. UFW/iptables firewall configured 4. Unattended security updates enabled
Hardening FAQ
What is the single most important hardening step?
Disable SSH password authentication and require keys. Password brute-force attacks are the most common way servers get compromised, and key-only authentication eliminates that whole class of attack.
Should I change the default SSH port?
It is a minor deterrent, not real security: scanners find any port. Keep it optional and focus on keys, fail2ban, and a firewall. Security through obscurity alone is not enough.
What does fail2ban do?
It watches logs for repeated failed attempts and temporarily bans the offending IP addresses via the firewall. It dramatically reduces brute-force noise on exposed services like SSH.
Why is automatic security patching important?
Most breaches exploit known vulnerabilities. Unattended-upgrades (Debian/Ubuntu) or dnf-automatic (RHEL/Fedora) install security patches promptly, shrinking the window between a disclosed vulnerability and your server being patched.
