SERVER HARDENING GUIDE 2026 Linux • Windows • Cloud • Anti-Ransomware • Hardening Scripts • Compliance
HARDENING GUIDE: Comprehensive server hardening guide covering Linux and Windows servers. Whether you're securing your own infrastructure or hardening compromised servers for operational use, these configurations will lock down any system against 95% of automated attacks.LINUX HARDENING CHECKLIST
| Category | Action | Command/Config | Priority |
| SSH | Disable password auth | PasswordAuthentication no | Critical |
| SSH | Change default port | Port 2222 | Medium |
| SSH | Key-based auth only | PubkeyAuthentication yes | Critical |
| SSH | Disable root login | PermitRootLogin no | Critical |
| Firewall | Default deny inbound | ufw default deny incoming | Critical |
| Firewall | Allow specific ports | ufw allow 80,443,2222 | Critical |
| Updates | Auto security updates | unattended-upgrades | High |
| 2FA | Enable for SSH | google-authenticator + PAM | High |
| Audit | Install auditd | auditctl -e 1 | Medium |
| Filesystem | Set immutable on critical files | chattr +i /etc/shadow | High |
| Kernel | Sysctl hardening | sysctl -w net.ipv4.conf.all.rp_filter=1 | Medium |
| Fail2ban | Intrusion prevention | fail2ban-client start | High |
| AppArmor | Mandatory access control | aa-enforce /path/to/bin | High |
| Logging | Centralized log server | rsyslog → remote syslog | Medium |
AUTOMATED HARDENING SCRIPT (LINUX)
Code:
#!/bin/bash
# Linux Hardening Script v4.2 — Run as root
echo "[*] Starting Linux hardening..."
# SSH Hardening
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
echo "Port 2222" >> /etc/ssh/sshd_config
systemctl restart sshd
# Firewall
ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable
# Automatic Updates
apt-get install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
# Fail2ban
apt-get install -y fail2ban
systemctl enable fail2ban
# Kernel Hardening
cat >> /etc/sysctl.conf << 'EOF'
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.accept_source_route=0
net.ipv4.tcp_syncookies=1
kernel.randomize_va_space=2
fs.suid_dumpable=0
net.ipv4.conf.all.log_martians=1
EOF
sysctl -p
# File Permissions
chmod 600 /etc/shadow
chmod 600 /etc/gshadow
chmod 644 /etc/passwd
chmod 644 /etc/group
chattr +i /etc/shadow
chattr +i /etc/gshadow
# Auditd
apt-get install -y auditd
auditctl -e 1
echo "-w /etc/passwd -p wa -k identity" >> /etc/audit/rules.d/audit.rules
echo "-w /etc/shadow -p wa -k identity" >> /etc/audit/rules.d/audit.rules
# Remove unnecessary services
systemctl disable avahi-daemon cups bluetooth whoopsie
echo "[✓] Hardening complete. Reboot recommended."
echo "[!] Remember to update your SSH config on client side (port 2222)"WINDOWS SERVER HARDENING
Code:
Windows Server 2022/2025 hardening:
1. Initial setup
- Rename Administrator account
- Create decoy "Administrator" account (no privileges, monitored)
- Enable: Windows Defender (real-time protection)
- Disable: SMBv1, LLMNR, NetBIOS over TCP/IP
2. Security Policy (secpol.msc)
- Password policy: 14+ chars, 90-day max age
- Account lockout: 5 attempts, 30 min lockout
- User Rights: Deny log on locally for guest
- Audit: Logon events, account management, policy change
3. Firewall (wf.msc)
- Block all inbound except: RDP (custom port), HTTP/HTTPS
- Block outbound except: updates, DNS, HTTP/HTTPS
- Log dropped packets
4. RDP hardening
- Change port (3389 → 3390+)
- Network Level Authentication (NLA)
- Restrict RDP to specific users/groups
- Session timeout: 15 min idle
- Clipboard/drive/print redirection: disable
5. Additional
- AppLocker: allow only approved executables
- Windows Defender ASR rules: enable all
- Disable PowerShell v2
- Set execution policy: RemoteSigned or Restricted
- Enable Credential Guard
- Enable Windows Defender Application Guard
Powershell script: Included in attachments (Hardening-Windows.ps1)DOWNLOAD
Code:
Hardening toolkit: [URL="https://mega.nz/file/BlackSec_ServerHardening_2026"]File on MEGA[/URL]
Size: 2 MB | Password: Hardening2026
Includes: Linux script, Windows script, CIS benchmark references, templates