A security checklist for a new server

A freshly created server starts getting scanned within minutes. Here's what's worth doing in the first hour to close the obvious risks.

Eight steps

1. Update the system: apt update && apt upgrade.
2. Create a separate sudo user; don't work as root.
3. Key-only login; disable password login.
4. Change the access port if you like and enable the firewall.
5. Leave only the ports you need open.
6. Install fail2ban against brute force.
7. Turn on automatic security updates.
8. Set up backups before there's important data.

A firewall in a couple of commands

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw enable

Next

These steps close the most obvious gaps. After that comes monitoring, regular updates and testing backups. Security isn't a one-time setup but a habit of coming back and checking.

← All notes