Linux Server Security Hardening: Complete 2026 Checklist

Every Linux server is scanned by bots within minutes of going online. CISA identifies unpatched Linux servers as a top ransomware vector in 2026. AI-assisted recon compresses exploitation from weeks to hours. 70%+ of production breaches trace to: weak SSH, unpatched services, over-exposed ports.

Step 1: Patch First

Run apt update && apt upgrade -y (Debian/Ubuntu) or dnf update -y (RHEL/Rocky). Enable unattended-upgrades. Apply sysctl hardening: net.ipv4.tcp_syncookies=1, disable ICMP redirects, kernel.dmesg_restrict=1, kernel.randomize_va_space=2.

Step 2: SSH Hardening

Edit /etc/ssh/sshd_config: PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 3, non-default port, AllowUsers whitelist, Ed25519/RSA-SHA2-512. Generate keys: ssh-keygen -t ed25519. Install Fail2Ban: bantime=3600, maxretry=3, enable sshd jail.

Step 3: Default-Deny Firewall

ufw default deny incoming && ufw default allow outgoing && ufw allow 2222/tcp && ufw allow 443/tcp && ufw enable. Audit monthly: ss -tlnp. Every unexplained open port is attack surface.

Step 4: Disable Unused Services

systemctl list-units –type=service –state=running. Disable: cups, avahi-daemon, bluetooth, postfix, rpcbind. Cannot justify it? Stop it.

Step 5: Mandatory Access Control

SELinux (RHEL): SELINUX=enforcing. AppArmor (Ubuntu): aa-enforce /etc/apparmor.d/*. Permissive mode logs only. Enforcing mode blocks.

Step 6: User Accounts

• Individual named admin accounts
• Minimal sudo: specific commands not ALL
• Audit UID 0: awk -F: $3==0{print} /etc/passwd
• Lock inactive: passwd -l username

Step 7: Audit Logging

Install auditd: apt install auditd -y. Watch /etc/passwd, /etc/sudoers, SSH config, all execve. Ship logs off-host to SIEM via rsyslog or Filebeat immediately.

Step 8: File Integrity

AIDE: aide –init, daily cron checks. Wazuh: real-time FIM, rootkit detection, CVE scanning.

Step 9: Lynis CIS Benchmark

lynis audit system. Target 80+. Run quarterly. CIS Benchmarks define the authoritative baseline.

Key Takeaways

• SSH key-only auth + Fail2Ban eliminates the most common brute-force path
• Default-deny firewall with only required ports reduces attack surface
• SELinux/AppArmor Enforcing mode contains compromised processes
• Ship audit logs off-host immediately to remote SIEM
• Measure hardening with Lynis vs CIS Benchmarks quarterly

Conclusion

Linux server hardening requires layered controls in priority order. Build into deployment templates, measure quarterly. Related: Network Security Best Practices.

Sources

• Linux Hardening Guide 2026 – linuxsecurity.com, mecanik.dev, linuxteck.com, zeonedge.com
• CIS Benchmarks – cisecurity.org
• CISA Advisories 2026 – cisa.gov

SSH and Kernel Hardening

Edit /etc/ssh/sshd_config: set PermitRootLogin no, PasswordAuthentication no, Protocol 2, ClientAliveInterval 300. For kernel: add net.ipv4.tcp_syncookies=1, kernel.randomize_va_space=2, fs.suid_dumpable=0 to /etc/sysctl.conf and apply with sysctl -p.

Auditd for Compliance Logging

Install auditd, log all sudo usage, privileged commands, and access to /etc/passwd. Forward logs to SIEM. Run aureport –summary weekly. Target Lynis score above 80.

Key Takeaways

• Disable SSH password auth – keys only
• SELinux or AppArmor in Enforcing mode always
• Automate CIS Level 1 baseline with Ansible
• Forward auditd logs to SIEM for compliance

Automated Compliance with Ansible

Use Ansible roles to automate CIS Benchmark application across your Linux fleet. Community roles like ansible-lockdown/RHEL8-CIS provide ready-made playbooks for major distributions. Run in check mode first to preview changes, then apply. Schedule quarterly re-runs to detect and remediate configuration drift. Store playbooks in Git and require peer review before applying to production servers.