Ten security steps for the first day of a new server

A server exposed to the internet becomes a target for automated scanners within minutes of installation. Those scans are not personal; they are bots sweeping address ranges looking for weak configuration.

The ten steps below close most of what those bots look for. All of them belong on day one.

1. Update the system

The most frequently exploited vulnerabilities are the ones patched months ago.

bashapt update && apt upgrade -y     # Ubuntu / Debian
dnf update -y                    # AlmaLinux / Rocky

2. Create a privileged user

Do not do daily work as root. A single mistyped command can have consequences you cannot undo.

bashadduser vdscim
usermod -aG sudo vdscim          # Ubuntu / Debian
# usermod -aG wheel vdscim       # AlmaLinux / Rocky

3. Set up an SSH key

Passwords can be guessed; keys cannot. Generate a key on your own machine:

bashssh-keygen -t ed25519 -C "vdscim-server"
ssh-copy-id vdscim@SERVER-IP

Before going further, open a new terminal and confirm you can log in with the key. The next step disables password login; if your key does not work you will lock yourself out.

4. Harden SSH

Set these lines in /etc/ssh/sshd_config:

textPermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Then restart the service:

bashsshd -t && systemctl restart sshd

sshd -t validates the configuration. Do not skip that check — restarting with a broken config can close the only door you have.

5. Configure the firewall

Deny everything by default and open only what you need.

bash# Ubuntu / Debian
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

bash# AlmaLinux / Rocky
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Never expose database ports (3306, 5432) to the internet. If you need remote access, use an SSH tunnel.

6. Install fail2ban

It temporarily blocks source IPs after repeated failed logins.

bashapt install -y fail2ban          # Ubuntu / Debian
dnf install -y fail2ban          # AlmaLinux / Rocky
systemctl enable --now fail2ban
fail2ban-client status sshd

7. Enable automatic security updates

bash# Ubuntu / Debian
apt install -y unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades

bash# AlmaLinux / Rocky
dnf install -y dnf-automatic
systemctl enable --now dnf-automatic.timer

8. Shut down services you do not need

Every running service is attack surface. Look at what is listening:

bashss -lptn

Stop and disable anything you do not recognise or do not use.

9. Set up backups and test a restore

A server without backups is one failure away from gone. More importantly: an untested backup is not a backup.

Keep backups off the server and, at least monthly, actually try restoring one.

10. Turn on monitoring

You cannot respond to a problem you never notice. At a minimum, watch:

• Disk usage — a full disk is the most common cause of a service failing silently
• Memory and CPU usage
• Failed login attempts (journalctl -u sshd)
• Certificate expiry dates

Is this enough?

These ten steps neutralise most automated scanning. Against a targeted attack the application layer has to be sound as well: current software, strong passwords, least privilege and regular log review.

Volumetric attacks at the network layer cannot be solved from inside the server; for those, see our DDoS protection guide.