---
title: "Secure a Linux Server in the First Hour: Checklist"
description: "A first-hour Linux server hardening checklist: automatic updates, a sudo user, key-only SSH, a firewall, fail2ban, backups, 2FA, monitoring and breach response."
url: "https://powerdedi.com/docs/secure-your-server"
last_updated: "2026-09-25"
publisher: "PowerDedi (https://powerdedi.com)"
---

# Secure your server in the first hour

A first-hour checklist: automatic updates, key-only SSH, a firewall, brute-force protection, backups and 2FA.

Updated September 25, 2026 · 4 min read · 10 sections

### All guides

Filter the guides

### Getting started

- [Get started with your dedicated server](https://powerdedi.com/docs/getting-started)

### Server management

- [Use the IPMI/KVM console](https://powerdedi.com/docs/ipmi-kvm-console)
- [Reinstall the operating system](https://powerdedi.com/docs/reinstall-os)
- [Repair your server with rescue mode](https://powerdedi.com/docs/rescue-mode)
- [Monitor and repair software RAID](https://powerdedi.com/docs/software-raid)

### Networking

- [Configure IPv6 on your server](https://powerdedi.com/docs/ipv6-configuration)
- [Test your server’s network speed](https://powerdedi.com/docs/network-speed-test)
- [Set up reverse DNS (PTR records)](https://powerdedi.com/docs/reverse-dns)

### Billing

- [Pay with cryptocurrency](https://powerdedi.com/docs/pay-with-crypto)

### Security

- [Secure your server in the first hour](https://powerdedi.com/docs/secure-your-server)
- [Create and use SSH keys](https://powerdedi.com/docs/ssh-keys)

Automated scanners start probing a new server within minutes of it going online. This checklist covers the essentials for your first hour. You need root access over SSH with your key installed; see [Create and use SSH keys](https://powerdedi.com/docs/ssh-keys). We don’t administer your operating system, so these steps are yours to take.

> Keep one SSH session open while you change SSH or firewall settings, and test each change from a second session. If you lock yourself out anyway, the [console](https://powerdedi.com/docs/ipmi-kvm-console) still works.

## Install updates automatically

```bash
# Debian, Ubuntu
sudo apt update && sudo apt full-upgrade
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# AlmaLinux, Rocky Linux
sudo dnf upgrade
sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer
```

On Debian and Ubuntu, unattended-upgrades installs security updates by default. New kernels only take effect after a reboot, so schedule one regularly.

## Work as a sudo user

```bash
sudo adduser alice && sudo usermod -aG sudo alice          # Debian, Ubuntu
sudo useradd -m -G wheel alice && sudo passwd alice        # AlmaLinux, Rocky Linux
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
sudo install -m 600 -o alice -g alice /root/.ssh/authorized_keys /home/alice/.ssh/
```

Give the user a strong password: sudo asks for it, and you need it to log in on the console. Check that `ssh alice@203.0.113.10` and `sudo -v` work before you continue.

## Allow SSH keys only

Create `/etc/ssh/sshd_config.d/00-hardening.conf`:

```ini
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
```

For each setting, sshd uses the first value it reads, so a file named `00-…` wins over later ones such as `50-cloud-init.conf`. Test the configuration, reload, and check the values in effect:

```bash
sudo sshd -t && sudo systemctl reload ssh      # Debian, Ubuntu
sudo sshd -t && sudo systemctl reload sshd     # AlmaLinux, Rocky Linux
sudo sshd -T | grep -Ei 'passwordauth|kbdinteractive|permitrootlogin'
```

Once your sudo user works, you can set `PermitRootLogin no`. On FreeBSD, make the same changes in `/etc/ssh/sshd_config` and run `service sshd reload`.

## Enable a firewall

First, see what is listening with `sudo ss -tulpn`: anything bound to `0.0.0.0` or `[::]` is reachable from the internet unless a firewall blocks it. On Debian, this ruleset in `/etc/nftables.conf` accepts SSH, loopback, ICMP and replies to your own connections, and drops everything else:

```text
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        ct state invalid drop
        iif "lo" accept
        meta l4proto { icmp, ipv6-icmp } accept
        tcp dport 22 accept
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
    }
}
```

```bash
sudo nft -c -f /etc/nftables.conf     # check syntax
sudo nft -f /etc/nftables.conf        # load now
sudo systemctl enable nftables        # load at boot
```

Add a rule such as `tcp dport { 80, 443 } accept` for each service you publish. Keep ICMP open: IPv6 doesn’t work without ICMPv6.

> `flush ruleset` deletes every existing rule, including those created by Docker, libvirt or the Proxmox VE firewall. On such hosts, use their own firewall integration instead.

On Ubuntu, ufw is simpler: `sudo ufw allow OpenSSH`, then `sudo ufw enable`. On AlmaLinux and Rocky Linux, firewalld is normally active and already allows SSH. Review it with `sudo firewall-cmd --list-all`, add services with `sudo firewall-cmd --permanent --add-service=https`, remove unused ones such as `cockpit` with `--remove-service`, then run `sudo firewall-cmd --reload`.

## Slow down brute-force attempts

With passwords disabled, guessing can’t succeed, but it fills your logs. fail2ban bans addresses that fail repeatedly. Install it with `sudo apt install fail2ban python3-systemd`, then create `/etc/fail2ban/jail.local`:

```ini
[sshd]
enabled = true
backend = systemd
maxretry = 5
bantime = 1h
```

Restart it with `sudo systemctl restart fail2ban` and check it with `sudo fail2ban-client status sshd`. On AlmaLinux and Rocky Linux, fail2ban comes from EPEL: run `sudo dnf install epel-release`, then `sudo dnf install fail2ban`. sshguard is a lighter alternative.

## Keep the clock in sync

Logs, TLS certificates and two-factor codes depend on accurate time. `timedatectl` should report `System clock synchronized: yes`. If it doesn’t, install the `chrony` package and enable its service.

## Back up your data

We don’t back up your data, and RAID isn’t a backup: it doesn’t protect against deletion, ransomware or a compromised system. Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site, for example on a server in another location. Tools such as restic and BorgBackup encrypt and deduplicate. Test a restore regularly.

## Protect your client area account

Anyone who can log in to your client area can reinstall your server, open its console or boot it into rescue mode. Enable two-factor authentication (TOTP) under **Account → Security**, and use a password you don’t use anywhere else.

## Monitor the server

Set up an external uptime check (ping or HTTP) that runs outside our network, alerts for disk space and load, and the RAID and SMART alerts described in [Monitor and repair software RAID](https://powerdedi.com/docs/software-raid). Network incidents are published on our [status page](https://powerdedi.com/status).

## If your server is compromised

1. Stop the damage. If the server attacks others, power it off or boot it into [rescue mode](https://powerdedi.com/docs/rescue-mode), which runs a clean system from the network.
2. Don’t trust the installed system. From rescue mode, copy off only the data you need, not programs or scripts, plus logs if you want to investigate.
3. [Reinstall the operating system](https://powerdedi.com/docs/reinstall-os). Cleaning up in place is never reliable.
4. Rotate every secret that was on the server or used to reach it: SSH keys, passwords, API tokens and database credentials.
5. Restore data from a backup made before the intrusion, fix the weakness the attacker used, and repeat this checklist before going live.

When we receive an abuse report about your server, we notify you and give you 24 hours to fix the problem; active attacks are stopped immediately with a null route or suspension. The details are in the [Acceptable Use Policy](https://powerdedi.com/legal/acceptable-use).

[← Previous **Pay with cryptocurrency**](https://powerdedi.com/docs/pay-with-crypto) [Next → **Create and use SSH keys**](https://powerdedi.com/docs/ssh-keys)

**Still stuck?**

Customers with an active server open a support ticket: tell us what you tried and an engineer takes it from there, usually within a few hours.

[Open a ticket](https://powerdedi.com/account/support)

## Related guides

[All guides](https://powerdedi.com/docs)

[Security](https://powerdedi.com/docs/category/security)

Updated September 25, 2026

### [Create and use SSH keys](https://powerdedi.com/docs/ssh-keys)

Generate an Ed25519 key on any OS, register it in the client area, install it on servers and shorten your logins.

3 min read

[Getting started](https://powerdedi.com/docs/category/getting-started)

Updated September 26, 2026

### [Get started with your dedicated server](https://powerdedi.com/docs/getting-started)

From order to first SSH login: choose a server, pay in crypto, connect, then run the first-ten-minutes checklist.

4 min read

[Server management](https://powerdedi.com/docs/category/server-management)

Updated September 25, 2026

### [Use the IPMI/KVM console](https://powerdedi.com/docs/ipmi-kvm-console)

See your server’s screen in the browser, control power, mount an ISO and reach the BIOS, even when the OS won’t boot.

4 min read

---

PowerDedi — Dedicated servers with 10 Gbps unmetered, paid in crypto. Page: https://powerdedi.com/docs/secure-your-server. Index of the site for AI assistants: https://powerdedi.com/llms.txt