Server Hardening Playbook

A practical, battle-tested checklist for locking down a production Linux server — written after learning some of these lessons the hard way.

Most "hardening guides" are either a wall of sysctl flags nobody applies, or a vendor benchmark you skim once and forget. This one is different: every item here maps to a real way servers get owned — an exposed port, a weak remote-desktop password, a secret in git, a database with no auth — and gives you the exact command to close it, plus how to verify it actually closed.

If you run a VPS, a side-project box, or a small fleet and you don't have a security team, this is for you.

The one lesson that matters most: a service is only as safe as the interface it listens on. A strong password on a service exposed to 0.0.0.0 is a weak setup. No password on a service bound to 127.0.0.1 behind a default-deny firewall is a strong one. Reachability beats secrecy. Start there.

If you do nothing else, do these five. They close the most common real-world entry points.

Anything that comes back "wrong" above has a dedicated section below.

Reachability first, then auth, then everything else. The order is deliberate. A misconfigured firewall or a service on the wrong interface is worth more to an attacker than a weak password, because it turns a local problem into a remote one. Fix what's reachable before you polish what's secret.