Hardening Linux web servers requires a defense-in-depth approach covering network port filtering, secure authentication protocols, file system permissions, and proactive vulnerability scanning. The essential starting point for securing any production environment is disabling root SSH password logins in favor of SSH public key authentication, combined with strict UFW or iptables firewall configuration closing all unnecessary open ports. Implementing these security baselines prevents automated brute-force attempts and restricts unauthorized server entry points.
Hardening Secure Shell (SSH) Access Protocols
Default SSH server configurations on port 22 are continuous targets for automated brute-force attacks across public IP spaces. To harden SSH access, edit /etc/ssh/sshd_config to set PasswordAuthentication no, PermitRootLogin no, and enforce strong cryptographic key exchange algorithms (Ed25519). Changing default port numbers reduces noise in authentication logs, while deploying automated tools like Fail2ban actively bans IP addresses displaying repeated failed connection attempts.
Implementing Strict Network Layer Firewalls with UFW and IPTables
Production servers must explicitly define accessible network interfaces and ports. Utilizing Uncomplicated Firewall (UFW) or iptables, set default incoming traffic policies to DROP, explicitly allowing inbound connections only on port 80 (HTTP), port 443 (HTTPS), and custom SSH administration ports. Restrict database ports (e.g., MySQL 3306 or PostgreSQL 5432) exclusively to local loopback interfaces (127.0.0.1) or trusted private network IPs.
Enforcing Precise Web Directory File System Permissions
Misconfigured file and folder permissions allow web application exploits to write malicious scripts directly into executable web directories. Ensure web root directories are owned by non-privileged administrative users with web server groups (e.g., www-data) having read-only execution permissions. Enforce strict numerical permission standards: 755 for directories and 644 for regular application files. Explicitly block script execution (such as .php) within upload folders via web server configuration directives.
Proactive Malware Detection and File Integrity Monitoring
Incorporate automated file integrity monitoring tools like AIDE or Tripwire to detect unauthorized modifications to core system binary files. Schedule daily malware scans using open-source tools like ClamAV combined with specialized web shell scanners like Maldet (Linux Malware Detect). Automated alert webhooks notify security teams immediately upon detecting altered files, enabling swift containment before unauthorized system compromise spreads.