First steps to secure a new Linux server

A new server is reachable from the internet within minutes of going online, and automated scanners will find it quickly. These steps cover the essentials for a typical Debian/Ubuntu or RHEL-family system. Adapt them to your distribution and policies.

1. Update the system

Install current security patches before anything else:

# Debian / Ubuntu
apt update && apt upgrade -y

# RHEL / AlmaLinux / Rocky
dnf upgrade -y

2. Create a non-root user

Work as a regular user and elevate with sudo only when needed:

adduser deploy
usermod -aG sudo deploy     # Debian / Ubuntu
usermod -aG wheel deploy    # RHEL family

3. Use SSH keys and restrict SSH

Set up key-based login for the new user (see How to connect with SSH). Then edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Reload SSH with systemctl reload sshd (or ssh on Debian/Ubuntu).

4. Enable a firewall

Allow only the services you actually use. With ufw on Debian/Ubuntu:

ufw allow OpenSSH
ufw allow 80,443/tcp   # only if you serve web traffic
ufw enable

With firewalld on the RHEL family:

firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

5. Slow down brute-force attempts

Tools such as fail2ban watch log files and temporarily block addresses that repeatedly fail to log in. With password logins disabled the risk is already low, but it also reduces log noise.

6. Keep security updates flowing

Enable automatic security updates — unattended-upgrades on Debian/Ubuntu or dnf-automatic on the RHEL family — and schedule time to review and reboot for kernel updates.

7. Monitor and back up

• Watch disk space, memory, load and failed logins, and alert on anomalies.
• Keep only the software you need; remove or disable unused services.
• Set up versioned, off-site backups before the server holds anything important — see Planning backups with the 3-2-1 rule.