Server Protection

Hardening begins with knowing why a server exists. Keep only the packages, listeners, identities, and data needed for that purpose. A smaller system is easier to patch, observe, and rebuild.

Establish the baseline

Capture the state before changing it:

date -Is
hostnamectl
uname -r
ip -brief address
ip route
sudo ss -lntup
systemctl --failed
systemctl list-unit-files --state=enabled

Compare every listening socket and enabled service with an approved requirement. Investigate unknown items before removing them; a port may belong to monitoring, cluster coordination, or a local-only application.

Patch by server family

sudo apt update
apt list --upgradable
sudo apt upgrade
test -f /var/run/reboot-required && cat /var/run/reboot-required

Prioritize internet-facing assets and vulnerabilities known to be exploited. CISA maintains the Known Exploited Vulnerabilities Catalog as an input to risk-based remediation; it is not a substitute for a complete vulnerability program.

Control administrative access

• Require individual identities. Do not share administrator accounts.
• Prefer short-lived access through an identity-aware gateway, VPN, or session manager.
• Disable direct root login and password authentication only after key-based access and a recovery path have been tested.
• Grant the smallest practical sudo scope and review it regularly.
• Remove access promptly when a role changes or a person leaves.

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries) '
sudo visudo -c
sudo last -ai | head
sudo journalctl -u ssh --since '24 hours ago'

sshd -T shows effective settings after includes and defaults. Make one access change at a time and keep an existing tested session open until a second session succeeds.

Restrict the network path

Use layers with distinct jobs:

1. A cloud firewall or security group allows only required sources and ports.
2. A load balancer or reverse proxy terminates public traffic where appropriate.
3. The host firewall mirrors the intended exposure.
4. The application binds to the narrowest useful address.
5. Databases and management services stay on private networks.

sudo ss -lntup
sudo nft list ruleset
curl -fsS http://127.0.0.1:3000/health

Do not use a temporary allow-from-anywhere rule as a troubleshooting shortcut. Test one path from a known source and inspect each control in order.

Protect data and recovery

• Encrypt disks, snapshots, object storage, and backup traffic with managed keys.
• Keep at least one backup copy outside the credentials and administration path of production.
• Protect deletion and retention settings with stronger authorization than routine writes.
• Restore into an isolated environment on a schedule and record recovery time and data loss.
• Store infrastructure definitions and approved images so a compromised host can be replaced.

References

• CISA Cross-Sector Cybersecurity Performance Goals
• CISA Known Exploited Vulnerabilities Catalog
• NIST Cybersecurity Framework 2.0