Initial setup of a freshly deployed Linux server is a critical stage. By default, fresh distributions may have vulnerabilities due to standard user accounts, open ports, or disabled firewalls.
In this article, we will review a basic security checklist for a Debian/Ubuntu-based server.
1. Connecting and Updating the System
First, connect to your server via SSH (usually as user root):
ssh root@your_server_ip
Once logged in, update the package list and install all pending security updates:
apt update && apt upgrade -y
2. Creating a New User with Sudo Privileges
Never perform routine tasks and administration under the root account. Create a new user and grant them administrator privileges.
Create a user (e.g., sysadmin):
adduser sysadmin
Add the user to the sudo group:
usermod -aG sudo sysadmin
Now switch to the newly created user for further work:
su - sysadmin
3. Setting Up SSH Key Authentication
Password authentication is vulnerable to brute-force attacks. Using SSH keys guarantees a high level of security.
Step 3.1. Key Generation (on your local computer)
If you don’t have a key pair yet, run this on your local machine:
ssh-keygen -t ed25519 -C "your_email@example.com"
Step 3.2. Copying the Key to the Server
Copy your public key to the server:
ssh-copy-id sysadmin@your_server_ip
After doing this, make sure you can log into the server via SSH without entering a password:
ssh sysadmin@your_server_ip
4. Hardening the SSH Server
Now disable password authentication and direct root login.
Open the SSH configuration file:
sudo nano /etc/ssh/sshd_config
Find and modify the following parameters (if they are commented out with #, remove the hash symbol):
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
MaxAuthTries 3
Save the file (Ctrl + O, then Enter) and exit (Ctrl + X).
Check the configuration for syntax errors:
sudo sshd -t
If there are no errors, restart the SSH service:
sudo systemctl restart ssh
Important! Do not close your current terminal session until you open a new window and verify that you can successfully connect via SSH as the new user using your key.
5. Setting Up a Firewall (UFW)
Blocking unused network ports is a security standard. Let’s install and configure ufw (Uncomplicated Firewall).
Install UFW (if not already installed):
sudo apt install ufw -y
Set default policies (deny all incoming, allow all outgoing):
sudo ufw default deny incoming
sudo ufw default allow outgoing
Allow SSH (make sure to do this before enabling the firewall, otherwise you will lose access!):
sudo ufw allow OpenSSH
# Or if using a non-standard port:
# sudo ufw allow 2222/tcp
Enable the firewall:
sudo ufw enable
Check status:
sudo ufw status verbose
6. Brute-Force Protection with Fail2ban
Fail2ban monitors service logs (such as SSH) and temporarily blocks IP addresses exhibiting multiple failed login attempts.
Install Fail2ban:
sudo apt install fail2ban -y
Create a local configuration file:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Open the configuration file:
sudo nano /etc/fail2ban/jail.local
Find the [sshd] section and ensure it is enabled:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
maxretry = 3
bantime = 1h
Save the file and restart the service:
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban
7. Configuring Automatic Security Updates
To receive security patches on time without manual intervention, configure the unattended-upgrades package.
Install the package:
sudo apt install unattended-upgrades -y
Configure automatic updates:
sudo dpkg-reconfigure -plow unattended-upgrades
Select Yes in the dialog window.
Conclusion
You have completed the basic security setup of your new Linux server:
- Created an isolated user with
sudoprivileges. - Configured secure SSH-key access (password and
rootlogins disabled). - Configured the firewall (UFW).
- Installed brute-force protection (Fail2ban).
- Enabled automatic security updates.
Now your server is ready for deploying applications and services!