Start with the attack surface

Hardening is about reducing unnecessary exposure while preserving required functionality. Begin with inventory, intended services and administrative paths.

1. Accounts and privilege

Remove or disable unnecessary accounts, use least privilege and review administrative access. Avoid routine work from privileged shells when a narrower account is sufficient.

2. SSH

Restrict SSH access to the users and networks that require it. Prefer strong authentication, disable unnecessary authentication methods and monitor authentication activity.

3. Services and network exposure

ss -tulpn
systemctl --type=service --state=running

Compare listening services with the intended server role. Remove or disable services that are not required rather than simply relying on obscurity.

4. Patching and logging

Maintain supported software versions and ensure security-relevant logs are retained and monitored. Hardening without visibility makes later investigation harder.

Baseline rule

Minimize services, minimize privileges, patch consistently and keep security-relevant activity observable.