Repolode
Submit
imthenachoman

imthenachoman/How-To-Secure-A-Linux-Server

A long-running, Debian-focused how-to guide covering SSH hardening, firewalls, intrusion detection, auditing and other steps for securing a home or personal Linux server.

View on GitHub
Stars
31,825
Forks
2,154
Open issues
32
Last commit
last month

What is it?

This project is a step-by-step guide to hardening a Linux server, aimed mainly at at-home or self-managed machines. It walks through the decisions to make before installing, then covers concrete configuration: key-based SSH login, restricting SSH access with groups, tightening sshd_config, enabling two-factor authentication, limiting sudo and su, and setting up UFW, Fail2ban, CrowdSec and PSAD for the network side.

The guide also covers auditing and monitoring, including AIDE file integrity checks, ClamAV, rkhunter, logwatch, Lynis and OSSEC, along with automatic security updates and mail alerts. Commands are written for Debian-based systems, and the author notes that most steps should carry over to other distributions with minor path or package-manager changes.

The guide is explicitly a work in progress, and it is meant to teach the reasoning behind each setting as well as provide copy-and-paste commands. It links to CIS benchmarks and distribution documentation for deeper, enterprise-grade hardening, and it includes an Ansible playbook companion project.

Key features

  • 01Step-by-step SSH hardening, including Ed25519 keys and a restricted sshd_config
  • 02Firewall setup with UFW and Docker-specific notes
  • 03Intrusion prevention with Fail2ban, CrowdSec and PSAD
  • 04Auditing tools such as AIDE, Lynis, rkhunter and OSSEC
  • 05Copy-and-paste commands written for Debian-based systems

Use cases

  • Hardening a home server that is reachable over SSH from outside the LAN
  • Learning the reasoning behind common Linux server security settings
  • Building a baseline checklist before applying stricter CIS benchmarks

Things to know

  • Several sections are marked work in progress (WIP), so coverage is incomplete.
  • It is focused on home servers and does not cover larger or professional environments.

Topics

#linux#security#hardening#ssh#firewall#server-administration#intrusion-detection#cc-by-sa#hardening-steps#linux-server

FAQ

What is How-To-Secure-A-Linux-Server?
A long-running, Debian-focused how-to guide covering SSH hardening, firewalls, intrusion detection, auditing and other steps for securing a home or personal Linux server. This project is a step-by-step guide to hardening a Linux server, aimed mainly at at-home or self-managed machines. It walks through the decisions to make before installing, then covers concrete configuration: key-based SSH login, restricting SSH access with groups, tightening sshd_config, enabling two-factor authentication, limiting sudo and su, and setting up UFW, Fail2ban, CrowdSec and PSAD for the network side.
Is How-To-Secure-A-Linux-Server free to use? What license does it have?
How-To-Secure-A-Linux-Server is open source under the CC-BY-SA-4.0 license. Check the license terms before using it in commercial products.
Is How-To-Secure-A-Linux-Server still maintained?
Updated within 6 months. The last commit to How-To-Secure-A-Linux-Server was on Sep 7, 2026.
What can I use How-To-Secure-A-Linux-Server for?
Hardening a home server that is reachable over SSH from outside the LAN Learning the reasoning behind common Linux server security settings Building a baseline checklist before applying stricter CIS benchmarks
Where can I get How-To-Secure-A-Linux-Server?
The source code and installation instructions are on GitHub: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects