First Steps on a New Linux Server: From Updates to Secure SSH

A new Linux server, whether in a data center or as a VM in your office, is usually delivered with a minimal installation and root access. A few simple tasks in the first hour make the server more secure and easier to manage, and set it up for years of stable operation. The commands below are written for the common Debian and Ubuntu distributions; on the RHEL family, such as Rocky Linux or AlmaLinux, use the equivalents with dnf and firewalld.

Update the system

The first task is installing all updates:

• On Debian and Ubuntu: apt update && apt upgrade
• On the RHEL family: dnf upgrade

If the kernel was updated, restart the server. To install security patches automatically on Debian and Ubuntu, install and configure the unattended-upgrades package; for sensitive servers, however, decide the restart time yourself.

A new user instead of root

Working as root every day means a single typo can break the whole system. Create a personal user and give it sudo access:

1. Create the new user with adduser.
2. Add it to the administrators group with usermod -aG sudo; on the RHEL family, this group is wheel.
3. Log in as this user in a new window and test sudo before you restrict root access.

Secure SSH with keys

Logging in with an SSH key is far more secure than a password. Create a key pair on your own system, for example with ssh-keygen -t ed25519, and place the public key on the server with ssh-copy-id. Once you’re sure key-based login works, apply these settings in /etc/ssh/sshd_config:

• PermitRootLogin no to prevent direct root login
• PasswordAuthentication no to disable password login

Then reload the SSH service. In newer versions, files in the /etc/ssh/sshd_config.d directory may also set these options and override yours; check them too.

Don’t close your current session until you’ve tested logging in with the new user and key in a separate session; otherwise you may lock yourself out and only be able to get back in through the provider’s console.

Firewall and protection against password guessing

Ubuntu includes the simple ufw firewall. Allow SSH first, then turn the firewall on:

1. ufw allow OpenSSH
2. The ports for your main service, for example ufw allow 443/tcp
3. ufw enable, then check with ufw status

If SSH must be open to the internet, a tool such as fail2ban blocks addresses with repeated failed logins for a period of time. Better still, restrict SSH to the office IP or VPN.

Basic settings

• Server name: Set a meaningful name with hostnamectl set-hostname.
• Time zone: Set the time with timedatectl set-timezone Asia/Tehran, using your own region, so log timestamps and scheduled tasks are correct. Keep time synchronization (NTP) enabled as well.
• Disk space and memory: Check the status with df -h and free -h, and if there is no swap, decide whether you need it.
• Running services: Use ss -tulpn to see which services are listening on which ports, and disable the ones you don’t need.

Checklist

• The system is fully up to date and security patches are installed regularly.
• A personal user with sudo access has been created.
• Key-based login is enabled, and root login and password login are disabled.
• The firewall is on and only the necessary ports are open.
• Server name, time zone and NTP are configured.
• Server backup has been planned before the main service is installed.

These few steps are the foundation of a reliable Linux server. ITPlus724 engineers can deploy, secure and maintain your cloud or on-premises Linux servers.