How do I secure a newly deployed Linux server? Start by securing a way back in, applying updates, limiting administrative privileges, closing unnecessary network access, and carefully validating SSH changes. Treat these as a baseline, not a universal configuration: the right settings depend on the server’s distribution, workload, and recovery options.
1. Establish a recovery route before changing remote access
If SSH is the only normal way to administer the server, a mistake in its configuration can lock you out. Before changing SSH settings, confirm that you have a working alternate route, such as a provider console or tested out-of-band access where available. This is a practical safeguard, not a requirement for any particular provider.
2. Patch the system and choose an update policy
Apply available updates promptly, then decide how future security updates will be installed, monitored, and followed up. Ubuntu’s general guidance recommends sudo apt update && sudo apt upgrade; those commands are for Ubuntu and other compatible APT-based systems, not every Linux distribution. See Ubuntu’s security suggestions.
Ubuntu documents unattended-upgrades as installed by default on Ubuntu Server and configured to run daily by default. Its logs are under /var/log/unattended-upgrades; the documented configuration files are /etc/apt/apt.conf.d/50unattended-upgrades and /etc/apt/apt.conf.d/20auto-upgrades. These paths and defaults are Ubuntu-specific and can vary by release or configuration. The Ubuntu automatic-updates guide explains how to inspect and configure the service.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
Automation does not remove the need for maintenance planning. Updates can restart affected services, and some require a system reboot. Ubuntu’s documentation says that beginning with Ubuntu 24.04 LTS, needrestart automatically restarts affected services by default; verify the behavior on the target release and configuration. Workloads with application-specific update steps may need a more controlled policy. Monitor update logs and service health so a failed update or unexpected restart is noticed.
Ubuntu’s security-updates documentation describes unattended-upgrades as included in default Ubuntu Desktop and Server installations from Ubuntu 18.04 LTS onward. It also documents defaults of 24 hours for security updates and 7 days for normal updates; these are documented Ubuntu behaviors, not guarantees for every release or configuration. Check the current Ubuntu security-updates documentation and your system’s settings before relying on those timings.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
3. Use a non-root account for routine work
Follow least privilege: use an account with only the access needed for its operator’s role, and elevate privileges for administrative tasks rather than working as root routinely. Ubuntu’s security suggestions recommend reserving root for administration and describe using sudo for privileged work.
Account creation, sudo policy, and any restrictions on which users or groups may connect over SSH should follow the distribution’s account-management guidance and the server’s operator model. Do not copy an access policy from another deployment without checking who needs access and how that access will be maintained.
4. Allow only the network traffic the server needs
Use a firewall and expose only the services required for the server’s role and management route. There is no universal port list: a web server, database, and privately managed host have different needs. Ubuntu documents UFW as its uncomplicated firewall tool, but other distributions and hosting environments may use different firewall and network-control tools. See Ubuntu’s security guidance.
Check host firewall rules alongside any cloud or hosting-provider firewall. A restrictive rule in one layer does not help if another layer still permits an unintended route. Verify the effective access paths after making changes, including the route you need for administration.
Rank #4
5. Harden SSH without risking a lockout
Choose an SSH authentication method and account policy that fit the people and systems administering the server. OpenSSH supports multiple authentication methods, and two-factor authentication is also possible; no single copied configuration is suitable for every operator model.
On Ubuntu, server settings can be in /etc/ssh/sshd_config or files in /etc/ssh/sshd_config.d/. Included drop-ins can affect the effective setting because OpenSSH uses the first value set for most directives. Check the files and their ordering rather than assuming a later edit overrides an earlier value.
Recommended Free Tools
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
- Keep a working session open. Before applying SSH changes, retain a tested session and confirm your recovery route from step one.
- Review the effective configuration sources. Inspect the main file and relevant drop-ins for the settings you intend to change.
- Test before restarting. On Ubuntu, run
sudo sshd -t. Correct any reported errors before proceeding. - Apply and verify the new access path. Restart or reload the service as appropriate for the distribution, then test a separate new connection before ending the working session.
Ubuntu warns that configuration mistakes can stop sshd from starting or prevent remote access. Its OpenSSH server guide covers Ubuntu’s files, validation, and configuration behavior; check the equivalent documentation for other distributions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Add controls that fit the workload and recovery plan
Beyond patching, least privilege, firewall rules, and carefully managed SSH, additional controls should be chosen against the server’s threat model, compatibility needs, operational burden, and recovery requirements.
- Mandatory access controls: Ubuntu identifies AppArmor as a way to restrict software permissions and access. Whether and how to use it depends on the applications and policies involved.
- Disk encryption: Ubuntu’s security guidance includes TPM-backed LUKS decryption. Consider hardware support and how the system will recover or unlock after a restart.
- Console security: Physical or virtual console access is another area to secure, especially when it offers a route around normal remote-access controls.
- Ubuntu support options: Ubuntu’s overview discusses Ubuntu Pro/ESM and Livepatch. These are Ubuntu-specific options; check current release eligibility and service terms rather than treating them as general Linux requirements.
Ubuntu’s overview says security depends on how a system is used and presents security as a layered practice. It describes five years of security support for Main packages in a standard Ubuntu LTS release, extended to ten years with Ubuntu Pro, subject to repository and severity qualifications. Confirm the applicable release and current terms in Ubuntu’s security overview; these figures are not Linux-wide support guarantees.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
