Linux hardening checklist
A short, practical checklist to run through right after you get root on a fresh VPS.
Why this exists
A freshly provisioned VPS is reachable from the whole internet immediately. This is a short checklist, not a full walkthrough — each item links to the topic that covers it properly.
1. Lock down SSH
Switch to key-based authentication and disable password login once your key works — password auth over the open internet is the single most common thing scanned and brute-forced.
2. Restrict root login
Once you have a working sudo user, disable direct root SSH login (PermitRootLogin no) so an attacker needs to guess both a username and get past key auth.
3. Enable a firewall
Default-deny inbound, then explicitly allow only what you're actually running (SSH, and HTTP/HTTPS if it's a web server). ufw on Debian/Ubuntu or firewalld on RHEL/Fedora are the friendliest front-ends.
4. Keep packages updated
Most distros support unattended security updates (unattended-upgrades on Debian/Ubuntu, dnf-automatic on RHEL/Fedora) — enable at least security-only automatic updates so known vulnerabilities get patched without you having to remember.
5. Add fail2ban
fail2ban watches auth logs and temporarily bans IPs after repeated failed login attempts — a cheap extra layer even with key-only SSH, since it also covers other exposed services.
sudo apt install fail2ban # or dnf/zypper
sudo systemctl enable --now fail2ban6. Don't run things as root
Create a dedicated, unprivileged sudo user for daily work and for running application services — running everything as root turns any single app bug into full system compromise.