Security hardening basics

0 / 15 lessons — 0%

Lesson 12 / 15

A freshly provisioned Linux box is not secure by default — it's just unconfigured. A short, boring checklist closes most of the easy attack surface.

Disable password SSH login, keys only (lesson 11) — removes the single most common attack vector on internet-facing boxes.
Disable root SSH login — force a real user + sudo, which also means every privileged action is attributable to a person.
Keep packages patched — apt upgrade / dnf update regularly, or enable unattended security upgrades.
Run a firewall, default-deny inbound, only open what's actually needed (lesson 5).
Least-privilege sudo — scoped rules, not blanket access (lesson 2).
fail2ban — watches auth logs and temporarily bans IPs after repeated failed login attempts.
Remove unused services — anything listening that nobody uses is pure attack surface with zero benefit.


# fail2ban — quick setup
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd


# what's actually listening, worth auditing periodically
ss -tulpn
sudo systemctl list-units --type=service --state=running

Most breaches aren't a zero-day exploit — they're a default password, an open port nobody remembered, or a stale account that should've been removed months ago. The boring checklist above closes more real risk than almost anything exotic would.

Try it yourselfOn any server you manage, run through the checklist above item by item and note what's actually configured versus what's still default. Even finding two unaddressed items is a genuinely useful audit.

← Lesson 11 Next: Lesson 13 →