Dedicated Server Security: Setup from Scratch

Why Dedicated Server Security Is Your Responsibility

If you own a dedicated server or VPS with root access, server security is entirely your responsibility. The hosting provider guarantees the network and physical infrastructure, but everything inside the operating system — from firewall settings to user permissions — is on you. This guide covers the essential steps to secure a fresh Linux server from scratch.

Step 1: Update the System Immediately

First thing after receiving your server — update all packages:

Ubuntu/Debian:

apt update && apt upgrade -y

CentOS/AlmaLinux:

dnf update -y

Updates patch known vulnerabilities. A server without updates is an open door. Enable automatic security updates:

apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

Step 2: Create a Non-Root User

Logging in directly as root is a security risk. Create a new user with sudo privileges:

adduser admin
usermod -aG sudo admin

Then disable root login via SSH:

PermitRootLogin no

In the file /etc/ssh/sshd_config.

Step 3: Secure SSH

SSH is the primary gateway to your server. Securing it is the top priority.

Change the Default Port

Switch from port 22 to a random port (e.g., 2847):

Port 2847

Use SSH Keys Instead of Passwords

ssh-keygen -t ed25519 -C "admin@company.com"
ssh-copy-id -p 2847 admin@server-ip

After confirming the key works, disable password authentication:

PasswordAuthentication no

Enable Two-Factor Authentication (2FA)

apt install libpam-google-authenticator -y
google-authenticator

This adds an extra protection layer even if your SSH key is compromised.

Step 4: Configure the Firewall

UFW (Ubuntu/Debian)

ufw default deny incoming
ufw default allow outgoing
ufw allow 2847/tcp # SSH
ufw allow 80/tcp # HTTP
ufw allow 443/tcp # HTTPS
ufw enable

firewalld (CentOS/AlmaLinux)

firewall-cmd --permanent --add-port=2847/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Golden rule: All ports closed by default, open only what you need.

Step 5: Install Fail2Ban

Fail2Ban protects against brute force attacks by banning IPs after failed attempts:

apt install fail2ban -y

SSH configuration:

[sshd]
enabled = true
port = 2847
maxretry = 3
bantime = 3600
findtime = 600

This bans any IP that fails login 3 times within 10 minutes for a full hour.

Step 6: Encrypt Data

SSL/TLS Certificates

apt install certbot python3-certbot-nginx -y
certbot --nginx -d example.com -d www.example.com

Disk Encryption

If handling sensitive data, enable disk encryption using LUKS:

cryptsetup luksFormat /dev/sdb
cryptsetup luksOpen /dev/sdb encrypted-data

Step 7: Encrypted Backups

Unencrypted backups are a security vulnerability. Use encrypted backups:

Item	Recommendation
Frequency	Daily + Weekly + Monthly
Encryption	AES-256
Storage	Separate location from server
Testing	Test restore monthly
Retention	7 days daily + 4 weeks weekly + 3 months monthly

CLOUD (cloud.net.sa) offers daily backup service starting at affordable pricing — pricing and plans per year with 7-day retention, or affordable pricing — pricing and plans per year with 30-day retention.

Step 8: Monitoring and Logging

System Logs

journalctl -f # Live monitoring
cat /var/log/auth.log # Login attempts
cat /var/log/syslog # System log

Monitoring Tools

• Netdata — Free real-time monitoring
• Prometheus + Grafana — Advanced monitoring
• Lynis — Comprehensive server security audit

Enable alerts for:

• CPU usage above 90%
• RAM usage above 85%
• Disk space below 10%
• Repeated failed login attempts

Quick Checklist

Item	Status
System update	Required immediately
Non-root user	Required
SSH keys + custom port	Required
Firewall	Required
Fail2Ban	Required
SSL/TLS	Required
Encrypted backups	Required
Monitoring and alerts	Required
Automatic updates	Recommended
2FA	Recommended

Conclusion

Server security is not a one-time operation — it is an ongoing process. Start with the basics outlined above, then evolve based on your needs. A secure server starts with reliable infrastructure. CLOUD (cloud.net.sa) provides servers in Saudi data centers with Tier III standards and DDoS protection available as an add-on at affordable pricing per year.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.