Secure a fresh Linux server
Take a brand-new server from default settings to keys-only SSH, a firewall, fail2ban and free HTTPS.
Intermediate, 9 steps, about 4 hours
- What is SSH? Know what you are locking down. Article CMP 0276
- SSH keys: create, copy and use them Replace passwords with keys before anything else. Article CMP 0345
- Harden a fresh Linux server in 30 minutes The checklist, in the right order, with a way back at every step. Article CMP 0352
- ufw and firewalld: open and close ports Only the ports you mean to serve stay open. Article CMP 0344
- fail2ban: block repeated failed logins Stop password guessing automatically. Article CMP 0353
- SSH server audit script: print risky sshd settings Check your work with a read-only script. Script CMP 0358
- TLS certificates explained Why the browser padlock exists and what it proves. Article CMP 0355
- Free HTTPS with Let’s Encrypt and certbot Put a real certificate on your site. Article CMP 0356
- Keep secrets out of git: .env files, gitignore and what to do after a leak Protect the keys that protect the server. Article CMP 0357