Server Hardening and Maintenance

July 16, 2026 ยท View on GitHub

Hardening reduces unnecessary access and limits the damage of a mistake or compromise. It is an ongoing process, not a one-time checklist.

Begin with a Minimal System

Install only required packages and services. Every listening process creates maintenance and attack surface.

Inventory listeners:

sudo ss -lntup

For each listener, record:

  • Process owner
  • Bind address
  • Port and protocol
  • Business purpose
  • Whether it must be public
  • Update responsibility

Disable or remove services with no owner or purpose after confirming dependencies.

Administrative Access

  • Use individual non-root accounts.
  • Use sudo for reviewed administrative commands.
  • Prefer cryptographic SSH keys protected by passphrases.
  • Restrict SSH network access where practical.
  • Disable obsolete authentication only after verifying a working recovery path.
  • Remove accounts promptly during offboarding.

Do not lock out the only recovery path while changing authentication.

File Permissions

Website files should be writable only by the deployment identity or controlled process that needs to update them. The web server normally needs read access, not ownership of every source and configuration file.

Find unusually broad permissions:

find /var/www/example.dpdns.org -xdev -type f -perm -0002 -print

Review results before changing permissions. Some collaborative workflows intentionally use group write access.

Patch Management

Create a routine for:

  • Operating system security updates
  • Web server updates
  • Application runtime updates
  • Dependency updates
  • Reboots required by kernel or core library changes
  • Verification after updates
  • Rollback when compatibility fails

Test major version changes in a nonproduction environment. Do not postpone critical updates indefinitely because no maintenance window was assigned.

Firewall Design

Default to denying unsolicited inbound traffic, then permit required services.

For a simple web server, public inbound access may be limited to:

TCP 80  HTTP and certificate validation workflow
TCP 443 HTTPS

Administrative access should be restricted according to the actual recovery and network design. Confirm IPv4 and IPv6 firewall policy separately.

Application Isolation

Run applications as dedicated service users with access only to required files and sockets. Keep database, cache, and internal application ports on private or local interfaces unless remote access is explicitly designed and protected.

Use operating system service controls for resource limits, restart policy, working directory, and environment loading.

Logs

Logs should support diagnosis without becoming a second sensitive database.

  • Rotate logs before they fill the disk.
  • Restrict access.
  • Avoid request bodies and credentials.
  • Redact tokens and cookies.
  • Keep synchronized system time.
  • Define retention based on operational and legal needs.
  • Monitor repeated authentication and application errors.

Security Headers and Application Controls

Server headers supplement application security. They do not repair SQL injection, broken authentication, or unsafe file uploads.

Deploy strict controls incrementally and observe their effect. In particular, test Content Security Policy and HTTP Strict Transport Security before long enforcement periods.

Vulnerability Reduction

  • Remove default pages and sample applications.
  • Disable directory listing unless intentionally required.
  • Keep management interfaces off public paths when possible.
  • Use secure cookie attributes for authenticated applications.
  • Protect state-changing requests against cross-site request forgery.
  • Apply rate limits based on endpoint risk and user impact.
  • Validate server-side input and output encoding.

Monthly Maintenance Checklist

  1. Review pending security updates.
  2. Review listening ports and service owners.
  3. Confirm backup and restoration tests.
  4. Check disk space and log rotation.
  5. Review account and SSH access.
  6. Check certificate renewal.
  7. Review DNS and nameserver changes.
  8. Remove abandoned files, records, and integrations.
  9. Test the public user path.
  10. Record completion and unresolved risks.

Hardening Lab

On a practice server you are authorized to administer:

  1. Capture the current listener list.
  2. Identify every public port.
  3. Confirm the owning process and package.
  4. Check whether the application runs as root.
  5. Review website directory permissions.
  6. Confirm update status.
  7. Confirm a backup exists before changes.
  8. Make one safe improvement and verify the service afterward.

Continue to Part 6: Advanced Reference.