Linux Security Hardening 2026: The Complete Problem-Solving Guide
By Huzi
File #541 · 3 min read
Spin up a fresh Ubuntu VPS and the bots arrive within minutes, knocking on port 22 with root and terrible passwords. Nearly all of it is automated opportunism, and it is defeated by one disciplined afternoon of hardening applied in the right order. Here is the checklist, lockout risks included.
The quick answer: Keys first, passwords never; allow your firewall ports before reload; then let fail2ban and auditd keep watch. That order is the whole difference between a hardened box and a locked-out one.
| Layer | Tool | What it stops |
|---|---|---|
| Login | Ed25519 key + sshd_config | Password-guessing bots on port 22 |
| Perimeter | firewalld | Traffic to ports nothing serves |
| Offenders | fail2ban | Repeat guessers jailed — maxretry 3, bantime 3600 |
| Evidence | auditd | Silent changes to sensitive files |
| Patching | unattended-upgrades | Security fixes sitting unapplied overnight |
SSH before anything else
Keys first, passwords never. Generate an Ed25519 pair on your laptop — never on the server — copy it across while password login still works, and test it in a second terminal before touching a single setting.
ssh-keygen -t ed25519 -C "deploy@my-laptop"
ssh-copy-id deploy@your-server-ip
Then tighten /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
AllowUsers deploy
Restart the daemon and keep your old session open until the new one proves itself. Disabling passwords before the key is confirmed is the classic way people lock themselves out of their own VPS.
The wall: firewalld
Ubuntu folk often reach for UFW; on Fedora, RHEL and CentOS Stream the tool is firewalld. The principle is identical either way — deny by default, open only what genuinely serves traffic.
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
Allow your working ports before you reload. The order is the whole trick.
Least privilege travels better than any packing cube: scatter only the copies a vendor needs and keep the originals on you. When the document side of a trip starts feeling like open ports, HTG Travels is the desk that closes them — visas, tickets, one custody chain.
fail2ban for the bots that remain
The firewall gates ports; fail2ban reads logs and jails the IPs that keep guessing. Put overrides in jail.local so package upgrades never clobber them:
[sshd]
enabled = true
maxretry = 3
bantime = 3600
ignoreip = 127.0.0.1/8 YOUR_HOME_IP
Pro tip: Add your own address to ignoreip before restarting — one bad evening of typos should not ban you from your own machine.
auditd: know when things change
A hardened box should also tell you when something changes on it. auditd watches sensitive files and writes a searchable trail:
sudo auditctl -w /etc/passwd -p wa -k identity
sudo auditctl -w /etc/ssh/sshd_config -p wa -k sshd_change
sudo aureport -k | tail -20
On Debian-family systems, add unattended-upgrades so security patches land overnight without you — and read /var/log/unattended-upgrades/ weekly, because a silent failed update is worse than none at all.
Apply the sequence — key tested, sshd tightened, firewall live, fail2ban watching, auditd recording — and the automated waves that sink careless servers simply bounce off yours.
Watching volunteers in Gaza rebuild their networks from salvaged machines and solar panels, the old free-software line about code being as free as its people stops sounding like a slogan and starts sounding like survival.
Redundancy is the quiet lesson of this whole post, and travel deserves it too. When an airline cancels at midnight, we at HTG Travels rebook our passengers before the counter queue forms — keep our number saved next to your backups. Plan first, pay later — reach the desk on +92 317 5054959 for conferences abroad, visas included.
