Server Hardening Checklist for Linux: Complete Guide for Indian Sysadmins

Why Server Hardening Is Non-Negotiable in 2026

A default Ubuntu or CentOS installation is not secure. It is optimised for compatibility, not security. Within minutes of being connected to the internet, an unhardened server will begin receiving automated attack attempts. This checklist covers the essential hardening steps for Indian sysadmins managing production Linux servers.

1. User and Authentication Security

• passwd -l root — Lock the root account
• Create a non-root admin user with sudo access
• Disable password authentication for SSH — use key pairs only
• Enforce strong passwords: minimum 14 characters, complexity requirements
• Set account lockout: 5 failed attempts → 30-minute lock (faillock)

2. SSH Hardening

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Protocol 2
Port 2222  # Change from default 22
MaxAuthTries 3
ClientAliveInterval 300
X11Forwarding no
AllowUsers your_admin_user

Restart SSH: systemctl restart sshd

3. Firewall Configuration (UFW/iptables)

ufw default deny incoming
ufw default allow outgoing
ufw allow from YOUR_ADMIN_IP to any port 2222 proto tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Only open ports that are genuinely required. Audit open ports monthly: ss -tlnp

4. System Updates

• Enable automatic security updates: unattended-upgrades
• Subscribe to distro security mailing lists
• Patch within 48 hours for critical CVEs

5. File System Security

• Mount /tmp with noexec,nosuid,nodev
• Mount /var/tmp with noexec,nosuid,nodev
• Set umask 027 for regular users, 077 for root
• Find SUID files: find / -perm -4000 -type f 2>/dev/null
• Remove unnecessary SUID bits

6. Kernel Hardening (sysctl)

Add to /etc/sysctl.conf:

net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
kernel.randomize_va_space = 2
kernel.dmesg_restrict = 1

7. Monitoring and Intrusion Detection

• Install Fail2ban — auto-bans IPs with repeated failed login attempts
• Install AIDE or Tripwire — file integrity monitoring
• Forward logs to central syslog (Graylog, ELK stack)
• Monitor failed sudo attempts, new user creation, cron changes

8. Regular Audit

• Monthly: Review open ports, active users, failed login reports
• Quarterly: Full CIS Benchmark scan using Lynis
• Annually: Full penetration test

For Indian businesses needing hands-on server security implementation, Serverwale's IT security team provides server hardening services with DPDP Act compliance documentation.