{"id":1090,"date":"2025-07-20T04:55:22","date_gmt":"2025-07-20T04:55:22","guid":{"rendered":"https:\/\/blog.vavencloud.com\/?p=1090"},"modified":"2025-07-20T04:55:22","modified_gmt":"2025-07-20T04:55:22","slug":"secure-your-linux-server-with-basic-firewall-and-ssh-hardening","status":"publish","type":"post","link":"https:\/\/blog.vavencloud.com\/?p=1090","title":{"rendered":"\ud83d\udd12 How to Secure Your Linux Server with Basic Firewall and SSH Hardening"},"content":{"rendered":"

Securing your Linux server is critical to protect your data, applications, and infrastructure from unauthorized access and attacks. Two foundational steps to improve your server security are configuring a firewall<\/strong> and hardening SSH (Secure Shell) access<\/strong>.<\/p>\n

In this guide, we’ll walk you through easy, effective measures to secure your Linux server \u2014 ideal for beginners and those managing VPS or dedicated servers.<\/p>\n

\n

1. Set Up a Basic Firewall Using UFW<\/h2>\n

UFW (Uncomplicated Firewall)<\/strong> is a user-friendly firewall tool commonly available on Ubuntu and Debian-based systems.<\/p>\n

\n

sudo ufw status<\/strong><\/p>\n<\/blockquote>\n

If it\u2019s not installed, install it:<\/p>\n

sudo apt install ufw -y<\/strong><\/p><\/blockquote>\n

Step 2: Allow SSH Connections<\/h3>\n

Before enabling the firewall, allow SSH to avoid locking yourself out:<\/p>\n

\n
    \n
  • sudo ufw allow ssh<\/li>\n<\/ul>\n<\/blockquote>\n

    Alternatively, if you use a custom SSH port (e.g., 2222):<\/p>\n

    \n
      \n
    • sudo ufw allow 2222\/tcp<\/li>\n<\/ul>\n<\/blockquote>\n

      Step 3: Allow HTTP and HTTPS (For Web Servers)<\/p>\n

      \n
        \n
      • sudo ufw allow http<\/li>\n
      • sudo ufw allow https<\/li>\n<\/ul>\n<\/blockquote>\n

        Step 4: Enable UFW<\/p>\n

        \n
          \n
        • sudo ufw enable<\/li>\n<\/ul>\n<\/blockquote>\n

          Step 5: Verify Firewall Status<\/p>\n

          \n
            \n
          • sudo ufw status verbose<\/li>\n<\/ul>\n<\/blockquote>\n

            2. Harden SSH Access<\/h2>\n

            SSH is your gateway to the server, so securing it is vital.<\/p>\n

            Step 1: Change Default SSH Port (Optional but Recommended)<\/h3>\n

            Edit SSH config file:<\/p>\n

            \n
              \n
            • sudo nano \/etc\/ssh\/sshd_config<\/li>\n<\/ul>\n<\/blockquote>\n
              Find the line:<\/div>\n
              \n
              #Port 22<\/div>\n<\/blockquote>\n
              \n

              Uncomment and change 22<\/code> to another port number (e.g., 2222<\/code>):<\/p>\n

              \n
                \n
              • Port 2222<\/li>\n<\/ul>\n<\/blockquote>\n
                \n

                Save and exit (Ctrl+O<\/code>, Enter<\/code>, Ctrl+X<\/code>).<\/p>\n

                Restart SSH service:<\/p>\n

                \n
                  \n
                • sudo systemctl restart sshd<\/li>\n<\/ul>\n<\/blockquote>\n
                  Remember to update your firewall rule if you changed the port:<\/div>\n
                  \n
                    \n
                  • sudo ufw allow 2222\/tcp<\/li>\n<\/ul>\n<\/blockquote>\n
                    \n

                    Step 2: Disable Root Login via SSH<\/h3>\n

                    In the same SSH config file (\/etc\/ssh\/sshd_config<\/code>), find:<\/p>\n

                    \n
                      \n
                    • PermitRootLogin yes<\/li>\n<\/ul>\n<\/blockquote>\n

                      Change it to:<\/p>\n

                      \n
                        \n
                      • PermitRootLogin no<\/li>\n<\/ul>\n<\/blockquote>\n

                        Save and restart SSH service again.<\/p>\n

                        \n

                        Step 3: Use SSH Key Authentication<\/h3>\n

                        SSH keys are more secure than passwords.<\/p>\n

                          \n
                        • \n

                          Generate SSH key pair on your local machine:<\/p>\n<\/li>\n<\/ul>\n

                          \n
                            \n
                          • ssh-keygen -t rsa -b 4096<\/li>\n<\/ul>\n<\/blockquote>\n
                              \n
                            • \n

                              Copy the public key to your server:<\/p>\n<\/li>\n<\/ul>\n

                              \n
                                \n
                              • ssh-copy-id -p 2222 username@your_server_ip<\/li>\n<\/ul>\n<\/blockquote>\n

                                Replace 2222<\/code> with your SSH port if changed.<\/p>\n

                                \n

                                Step 4: Disable Password Authentication<\/h3>\n

                                Once SSH keys work, disable password login for SSH.<\/p>\n

                                Edit \/etc\/ssh\/sshd_config<\/code>:<\/p>\n

                                \n
                                  \n
                                • PasswordAuthentication no<\/li>\n<\/ul>\n<\/blockquote>\n

                                  Save and restart SSH:<\/p>\n

                                  \n
                                    \n
                                  • sudo systemctl restart sshd<\/li>\n<\/ul>\n<\/blockquote>\n

                                    3. Additional Security Tips<\/h2>\n
                                      \n
                                    • \n

                                      Keep your system updated<\/strong><\/p>\n<\/li>\n<\/ul>\n

                                      \n
                                        \n
                                      • sudo apt update && sudo apt upgrade -y<\/li>\n<\/ul>\n<\/blockquote>\n
                                          \n
                                        • Install Fail2Ban to block suspicious IPs:<\/li>\n<\/ul>\n
                                          \n
                                            \n
                                          • sudo apt install fail2ban -y<\/li>\n<\/ul>\n<\/blockquote>\n
                                              \n
                                            • Regularly review SSH login attempts:<\/li>\n<\/ul>\n
                                              \n
                                                \n
                                              • sudo tail -f \/var\/log\/auth.log<\/li>\n<\/ul>\n<\/blockquote>\n

                                                Final Thoughts<\/h2>\n

                                                Basic firewall setup and SSH hardening are vital first steps to secure your Linux server. These measures help prevent unauthorized access and reduce attack surfaces \u2014 keeping your data and apps safe.<\/p>\n

                                                For a more streamlined, automated experience, consider VavenCloud\u2019s managed VPS<\/strong> services, where security best practices come pre-configured with continuous monitoring and support.<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

                                                Securing your Linux server is critical to protect your data, applications, and infrastructure from unauthorized access and attacks. Two foundational steps to improve your server security are configuring a firewall and hardening SSH (Secure Shell) access. In this guide, we’ll walk you through easy, effective measures to secure your Linux server \u2014 ideal for beginners […]<\/p>\n","protected":false},"author":1,"featured_media":1092,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-1090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server-security"],"_links":{"self":[{"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/wp\/v2\/posts\/1090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1090"}],"version-history":[{"count":0,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/wp\/v2\/posts\/1090\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=\/"}],"wp:attachment":[{"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.vavencloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}