Linux Server Hardening Checklist

What this checklist is

A Linux server hardening checklist for a VPS or cloud VM that runs your app. It covers user accounts and sudo, SSH, security updates, open ports and the firewall, system settings and permissions, logging, and checking the result against a CIS benchmark, with a command to verify every check.

It has 7 chapters and 38 checks, each with how to verify it and how much it matters. For developers who run their own Linux servers.

Chapter by chapter

1. User accounts and sudo (5 checks)

Checks that every person has their own account, nobody works as root, and admin rights are limited and traceable.

2. SSH (7 checks)

Checks on the front door: key-only logins, no root, a tested configuration and as little exposure as possible.

3. Updates and packages (5 checks)

Checks that the system gets security fixes without anyone remembering to, reboots when it must, and runs only software you need.

4. Open ports and the firewall (6 checks)

Checks that only the services you intend are listening, and that a firewall blocks everything else even if a new service starts by mistake.

5. System settings and file permissions (6 checks)

Checks on the operating system itself: mandatory access control, kernel network settings, sensitive file permissions and mount options.

6. Logging, time and integrity (5 checks)

Checks that the server keeps a trustworthy record of what happened, somewhere an attacker on the box cannot erase it.

7. Benchmarks, configuration and recovery (4 checks)

Checks that compare the server against a published baseline, keep its setup reproducible, and make sure you can recover it.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (7 cited).