Member-only story
The 30-Minute Linux Server Hardening Baseline I Apply to Everything
Most of the checklist is already done. Here’s the part that isn’t.
Last year I inherited a fleet of Ubuntu boxes from a team that had moved on. Someone had clearly “hardened” them — there was a Ciphers line sitting in sshd_config, pinning a fixed list of algorithms.
The list came from a blog post written around 2016. It had been quietly freezing those servers’ SSH crypto in amber ever since, straight through the years when OpenSSH started shipping better defaults than anything in the paste.
That’s the failure mode nobody warns you about. Hardening that pins is hardening that rots.
Here’s the baseline I apply now instead. It takes about thirty minutes, a surprising amount of it is removing things previous admins copied in, and every step ends with a command that proves it worked.
Why the checklists exist, and why most of them are stale
SSH brute-forcing is real and constant. Any box with a public IP starts collecting login attempts within minutes, auditors ask for evidence, and nobody wants to be the person who left password auth on.
So a genre grew: the twenty-item hardening checklist, mostly copied between posts and rarely re-verified…
