Hardening means making a server harder to attack by removing what you do not need and watching what is left. These steps are written for Debian and Ubuntu and work well on a fresh lab server or VPS.

Want every command on one page? Linux & Enterprise Configuration Guide · $9.99View on Gumroad

1. Update first

sudo apt update && sudo apt upgrade -y

2. Use a normal user, not root

sudo adduser admin1
sudo usermod -aG sudo admin1

3. See what is listening, then remove what you do not need

sudo ss -tulpn

Every listening port is a door. If a service is not needed, stop it and stop it starting again at boot (cups is just an example):

sudo systemctl disable --now cups

4. Turn on a firewall with a default deny

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Only open 80 and 443 if the server runs a web service.

5. Add Fail2ban

Fail2ban reads your logs and temporarily blocks IP addresses that keep failing to log in.

sudo apt install fail2ban

Create /etc/fail2ban/jail.local so updates never overwrite your settings:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

If you ban yourself by mistake, remove the ban with:

sudo fail2ban-client set sshd unbanip YOUR.IP.ADDRESS

6. Check your logs

sudo journalctl -u ssh --since today

Look for repeated failed logins. Seeing them proves the protection is needed, and seeing the bans proves it works.

7. Protect important files

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

For the SSH side in more detail, including key login and disabling root, see the SSH hardening checklist below.