Linux Server Hardening

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Linux Server Hardening, no intimidation required
Apply this concept right away in real-world scenarios
Learn to avoid security risks for yourself and others

Let's think about it this way for a second

Server hardening means changing default settings into secure configurations — it's about shrinking the attack surface (the entry points an attacker could use). Key hardening steps: disable SSH password authentication and switch to key-only authentication, disable root login over SSH, close unused services/ports, use fail2ban to ban an IP after repeated login failures, and set up security updates to install automatically.

Let's connect this to a real-world scenario

Setting PasswordAuthentication no and PermitRootLogin no in the SSH config file (/etc/ssh/sshd_config) eliminates brute-force password attack risk entirely (allowing only key-based auth). Installing fail2ban and enabling its SSH jail will automatically ban an IP address for around 10 minutes after 5 consecutive login failures.

Disable SSH password authentication and switch to key-only
Disable SSH root login
Install fail2ban to ban repeated login failures

Let's look at it together

bash

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no

# Restart SSH service to apply
sudo systemctl restart sshd

# Install fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban --now

You should see

Be able to name 2 SSH hardening configs (disabling password auth, disabling root login) and explain what fail2ban does.

Try it in 5 minutes

Revisit the SSH/Firewall lesson from the Linux tutorial and practice running 3 items from this hardening checklist on a VM/WSL (don't do this on a root or production server).

A quick word of caution

After changing your SSH config, test logging in from a new terminal before closing your existing connection — a config mistake can lock you out of the server entirely.

Easy traps

Disabling PasswordAuthentication before making sure your SSH key is already uploaded to the server — skip this and you can get locked out (remember the firewall lesson from the Linux tutorial)
Installing fail2ban but never configuring or enabling it

Now try it yourself

Revisit the SSH/Firewall lesson from the Linux tutorial and practice running 3 items from this hardening checklist on a VM/WSL (don't do this on a root or production server).

You'll know it worked when: Be able to name 2 SSH hardening configs (disabling password auth, disabling root login) and explain what fail2ban does.