Server security: practical hardening tips for developers and administrators

An unsecured server is like a house with open windows in a busy neighborhood – it is not a question of whether, but when it will be broken into. In this article, we provide practical hardening tips to secure your Linux and Windows servers against common threats. No theoretical lists, but directly applicable techniques for developers and system administrators.

Why server hardening is essential

Servers are constantly exposed to automated scans and targeted attacks. Without hardening:

• Weak SSH passwords are cracked within hours
• Vulnerable services (such as old PHP) remain accessible
• Firewalls can open the wrong ports

These steps will increase security immediately:

1. Firewall configuration: the first line of defense

Windows: netsh advfirewall

Configure the Windows Firewall with Advanced Security via PowerShell:

netsh advfirewall set allprofiles state on
netsh advfirewall firewall add rule name="Block inbound port 22" dir=in action=block protocol=TCP localport=22

Linux (Proxmox): pve-firewall

With Proxmox VE, use the built-in firewall tool:

pve-firewall compile Show all rules
pve-firewall local Check local network

2. SSL/TLS hardening: encryption in order

Use testssl.sh or sslscan to detect weak protocols:

testssl example.com:465 Test custom port
sslscan --show-certificate example.com

Important findings:

• Disable SSLv2/v3 and TLS 1.0/1.1
• Block weak ciphers (RC4, DES)
• Enable HSTS (HTTP Strict Transport Security)

3. System updates and minimization

A hardened server runs only necessary services:

sudo apt purge telnetd rsh-server Remove unused packages
sudo systemctl list-unit-files --state=enabled Check active services

Automate updates:

• Ubuntu/Debian: unattended-upgrades
• CentOS/RHEL: yum-cron
• Windows: Group Policy for automatic updates

4. Access control and authentication

Basic principles for strong access security:

SSH hardening (Linux)
PermitRootLogin no
PasswordAuthentication no Use SSH keys only
MaxAuthTries 3

For Windows:

• Disable NTLMv1 via Group Policy
• Enable LSA protection
• Use RestrictedAdmin mode for RDP

5. Monitoring and logging

Detect suspicious activities with:

sudo fail2ban-client status Block brute-force attacks
journalctl -u sshd --since "1 hour ago" Check SSH logins

Windows alternatives:

• Windows Defender Firewall logs
• Event Viewer for security events (ID 4625 for failed logins)

Conclusion: a hardened server in 5 steps

Server hardening is not a one-time task but an ongoing process. This checklist will help you get started:

1. Configure the firewall strictly (per port/protocol)
2. Scan and fix SSL/TLS settings
3. Remove unnecessary software and automate updates
4. Implement strong authentication (2FA/SSH keys)
5. Monitor logs for suspicious activities

With these practical hardening tips, you will significantly reduce the attack surface. For critical systems, consider additional measures such as SELinux/AppArmor or an intrusion detection system (IDS).