Linux server hardening checklist for 2026: 40 settings, with the commands to apply them.

This checklist covers Ubuntu 22.04 and 24.04, Debian 12 and 13, RHEL 9 and its rebuilds (Rocky, AlmaLinux), and Amazon Linux 2023. It follows the spirit of the CIS Benchmarks Level 1 but is written for people who have to keep production running. Every item has an ID that matches the check in our audit script, so you can go straight from a FAIL in the report to the fix here.

1. Patching and OS lifecycle

# Debian / Ubuntu
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# RHEL / Rocky / Alma / Amazon Linux 2023
sudo dnf install dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic-install.timer

2. SSH

SSH is the front door of almost every Linux server, and the most common finding we report on it is still password authentication left on. Put your settings in a drop-in file so package updates do not overwrite them.

# /etc/ssh/sshd_config.d/10-hardening.conf
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitEmptyPasswords no
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
AllowTcpForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
AllowGroups ssh-users
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

sudo groupadd -f ssh-users && sudo usermod -aG ssh-users "$USER"
sudo sshd -t && sudo systemctl reload ssh   # 'sshd' on RHEL
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|maxauthtries'

On RHEL and its rebuilds, leave the KexAlgorithms, Ciphers and MACs lines out and set the algorithms system-wide with crypto policies instead (on RHEL 9 the DEFAULT policy already drops the weakest algorithms; sudo update-crypto-policies --set FUTURE is stricter if all your clients support it), so SSH, TLS and other libraries stay consistent.

3. Users, passwords and sudo

4. Firewall and exposed services

Every port that answers on a public interface is attack surface. First see what listens, then close what should not be there.

sudo ss -tulpn

# Ubuntu / Debian
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp   # your office or VPN range
sudo ufw allow 443/tcp
sudo ufw enable

# RHEL family
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --remove-service=cockpit
sudo firewall-cmd --permanent --add-service=https && sudo firewall-cmd --reload

5. Kernel and network sysctl hardening

These settings cost nothing on a typical server and close off whole classes of local exploits and network tricks.

# /etc/sysctl.d/60-hardening.conf
kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.yama.ptrace_scope = 1
kernel.unprivileged_bpf_disabled = 1
fs.suid_dumpable = 0
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.log_martians = 1
net.ipv6.conf.all.accept_redirects = 0

sudo sysctl --system

Leave net.ipv4.ip_forward = 1 only on hosts that route traffic, such as Docker and Kubernetes nodes or VPN gateways (NET-020). Keep SELinux in enforcing mode on RHEL and AppArmor enabled on Ubuntu (KRN-010); fix denials with audit2why rather than switching enforcement off.

6. File permissions and privilege escalation paths

These are exactly what tools like linPEAS look for after a foothold, so find them first. Our Lynis vs linPEAS comparison explains the attacker’s view.

sudo find / -xdev -perm -4000 -type f 2>/dev/null
sudo chmod u-s /usr/bin/find              # remove SUID from anything that should not have it
sudo find /etc/cron* /var/spool/cron -perm -o+w -type f 2>/dev/null

7. Logging, monitoring and time

sudo apt install auditd fail2ban        # or: sudo dnf install audit fail2ban
sudo systemctl enable --now auditd fail2ban

8. Web servers and applications

Check the whole list in one command

Working through forty items by hand on every server does not scale. Sumrite’s free server security audit script checks nearly everything above, gives the server a score out of 100, and shows the fix for each finding. It is read-only and makes no network connections.

curl -fsSL https://sumrite.com/audit.sh | sudo bash

Run it before and after hardening, then weekly from cron with --fail-under 80 so a regression raises an alert. The five-minute server audit guide explains the score and scheduling.