What is the first thing I should do after buying a server?

Run a full update, create a normal user with an SSH key, disable direct root login, and enable UFW with a deny-by-default policy. After that, open only the services you truly need.

Why should I disable PasswordAuthentication?

Password brute-forcing is the most common way bots get in. With a strong public key and password login disabled, that path is effectively closed.

fail2ban is a good layer, but it doesn't replace hardening SSH and the firewall — treat them as complementary, not substitutes.

How can I tell if my server has been hacked?

Unusual CPU/RAM usage, suspicious outbound connections, new users or files, and unexpected log entries. Tools like rkhunter and lynis are also useful for a first pass.

Linux Server Hardening: A Complete, Up-to-Date Checklist for Admins

A recurring theme in security reports: most real breaches are not the result of sophisticated tricks — they come from outdated software, weak passwords and unnecessary open services. Hardening means minimizing exactly those three things; lay the foundation first, then move on to advanced tools.

Updates: the simplest and most important step

Run sudo apt update on a regular schedule
Configure unattended-upgrades for automatic updates (security packages only)
Schedule a reboot after every kernel update

Most ransomware and bots exploit the same old vulnerabilities that were patched years ago.

Hardening SSH access

Disable direct root login: set PermitRootLogin to no in sshd_config
Create a normal user with sudo and log in with a public key
Set PasswordAuthentication no after you've tested your keys
Changing the default port, combined with limiting source IPs in the firewall, is a better approach

Close the remaining ports completely in Firewall and Configuration Basics.

Firewall and services

Configure the firewall with a deny-by-default policy:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

And don't install — or do disable — unused services: telnet, FTP, and unneeded web server modules.

The principle of least privilege: the right keyword

Run applications under their own dedicated user (not root)
Make web directories read-only and open only upload directories with tight permissions
Secure sessions and cookies (HttpOnly, SameSite)

If you want to deepen the security concept, read CIA Principles in Network Security; least privilege is essentially an effort to preserve 'confidentiality'.

Monitoring and containing attacks

Logs: track SSH in rsyslog/journald and review Apache/Nginx errors
fail2ban: curb repeated login attempts by banning IPs
Tools like unattended-upgrades track security patches, but review the logs yourself too

Backup and recovery

Keep encrypted backups separate from the server (offline or on another service)
Regular restore testing is part of the cycle (a backup without testing means nothing)
Restrict backup access with two-factor authentication and a separate key

Hardening is a routine, not an event

After every change, run a hypothetical attack scenario: view the new service with nmap, attempt a wrong login, and check the log output. Rerun this checklist every six months so no door is left open. If you are just getting started, you can do all of these exercises in Kali — see Installing Kali Linux.