5 Steps to Secure Linux (protect from hackers)

Securing a Linux server isn’t about a single magic setting—it’s about stacking practical defenses that close the most common entry points. The core takeaway is a five-step hardening routine: keep the system patched automatically, stop using the root account for SSH, replace password logins with SSH keys, tighten SSH daemon settings (including a non-default port), and then enforce a firewall that only allows the ports you truly need. Together, these steps dramatically reduce the odds that routine scanning and brute-force attempts turn into a breach.

The process starts with updates, because unpatched systems remain the easiest target. After creating or selecting a Linux VM (the walkthrough uses a Debian 10 instance on Lenode), the routine moves to SSH access and then enables unattended upgrades. It also includes manual update commands (apt update and apt upgrade) as a fallback. The key move is installing unattended-upgrades and configuring it to automatically download and install stable updates, so security fixes land without relying on memory.

Next comes account hygiene: root login over the internet is treated as a hard “no.” Instead of logging in as root, a new user is created and added to the sudo group so administrative tasks still work when prefixed with sudo. The walkthrough demonstrates the difference in permissions by showing that commands fail without sudo, then succeed when sudo is used—effectively granting “root powers” only for specific commands.

The third hardening layer replaces password authentication with SSH public/private keys. The routine creates a .ssh directory with locked-down permissions (chmod 700), generates a 4096-bit key pair (ssh-keygen -b 4096), and uploads the public key to the server’s authorized_keys using scp (or the simpler ssh-copy-id flow). After that, SSH logins proceed without entering a server password, eliminating the brute-force risk that comes with passwords.

Step four locks down SSH itself by editing /etc/ssh/sshd_config. The walkthrough changes the SSH port from the default 22 to a high, random port (example: 717), forces IPv4-only, disables root login (PermitRootLogin no), and turns off password authentication (PasswordAuthentication no). It then restarts sshd and tests connectivity using the custom port to avoid accidentally locking itself out.

Finally, the firewall becomes the perimeter. The routine checks open ports with ss -tulpn, installs ufw (Uncomplicated Firewall), allows only the custom SSH port, and enables ufw so everything else is blocked by default. It demonstrates the effect by installing Apache 2, confirming port 80 is reachable only after explicitly allowing it through ufw. To reduce visibility, it also blocks ICMP echo requests (ping) by editing /etc/ufw/before.rules and then reloading rules and rebooting to ensure the change takes effect.

The closing message is blunt: nothing is unhackable. But these best-practice controls—patching, least privilege, key-based SSH, hardened sshd settings, and a default-deny firewall—address the most common failure modes that lead to real-world compromises.