A consolidated, comprehensive checklist bringing together this entire category's security hardening guidance into one reference — use it to systematically harden a new server or audit an existing one.
Access Control
- ☐ SSH key authentication configured, password authentication disabled (see SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys)
- ☐ Root SSH login disabled
- ☐ Non-default SSH port configured
- ☐ Two-factor authentication enabled for SSH (see How to Enable Two-Factor Authentication (2FA) for SSH on a Linux VPS)
- ☐ Dedicated sudo user created for daily use, not working as root (see How to Create a New User with Sudo Access on a Linux VPS)
Network Security
- ☐ Firewall configured with default-deny, explicit allow rules (see How to Configure UFW Firewall on a Linux VPS)
- ☐ Only genuinely necessary ports exposed
- ☐ Fail2Ban installed and configured (see How to Install and Configure Fail2Ban on Ubuntu & Debian)
- ☐ Kernel network parameters hardened (see How to Harden Kernel Parameters for Security)
System Updates
- ☐ Automatic security updates enabled (see How to Enable Automatic Security Updates on Ubuntu & Debian)
- ☐ Regular manual review of update status beyond automation alone
Monitoring and Detection
- ☐ Auth log monitoring configured (see How to Monitor Auth Logs and Detect Intrusion Attempts on a Linux VPS)
- ☐ File integrity monitoring set up (see How to Set Up File Integrity Monitoring with AIDE)
- ☐ Rootkit scanning scheduled (see How to Detect and Remove Rootkits on a Linux VPS)
- ☐ Regular Lynis security audits (see How to Set Up Security Auditing with Lynis)
File System Security
- ☐ File/directory permissions audited (see How to Audit and Fix File and Directory Permissions on a Linux VPS)
- ☐ No unnecessary world-writable files
- ☐ SUID/SGID binaries reviewed for legitimacy
Application-Level Security
- ☐ Principle of least privilege applied (see How to Implement the Principle of Least Privilege on a Linux VPS)
- ☐ AppArmor/SELinux profiles active where applicable (see How to Set Up AppArmor for Application Sandboxing)
- ☐ Dependencies audited for known vulnerabilities (see How to Audit Installed Packages for Known Vulnerabilities)
- ☐ Cron jobs secured (see How to Secure Cron Jobs and Scheduled Tasks)
Attack Surface Reduction
- ☐ Unnecessary services disabled/removed (see How to Disable Unnecessary Services to Reduce Attack Surface)
- ☐ Unused user accounts audited and removed (see How to Audit User Accounts and Remove Unused Ones)
Backup and Recovery
- ☐ Automated backups configured (see How to Set Up Automated VPS Backups)
- ☐ Backup restoration actually tested
- ☐ Backups encrypted (see Backup Encryption: Protecting Your Backups from Unauthorized Access)
Incident Preparedness
- ☐ Familiar with compromise response process (see How to Detect and Respond to a Compromised VPS)
- ☐ Documented incident response plan exists
Using This Checklist
Work through this systematically for a new production deployment, or as a periodic (quarterly recommended) audit of existing servers — treat it as a living reference, revisiting as your specific server's role and threat model evolves over time.
Continue Reading
- VPS Security Checklist for Beginners
- How to Harden a Fresh Linux VPS in 15 Minutes
- How to Set Up Security Auditing with Lynis
Browse more articles in Server Security & Hardening.
