Boost Your Server Security: Essential SSH, User, and Sudo Hardening Steps

Securing a newly purchased server is crucial; the following steps provide a straightforward hardening checklist for Linux systems.

Modify SSH login configuration

Edit the SSH daemon configuration file and adjust key parameters:

vim /etc/ssh/sshd_config

# Change the listening port (use a value > 10000 to reduce scanning)
Port 10000

# Use only SSH protocol 2 (disable the insecure version 1)
Protocol 2

# Disallow direct root login; use a regular account and <code>su

instead PermitRootLogin no # Disable empty passwords PermitEmptyPasswords no

After saving, restart the SSH service:

service sshd restart

Disable system response to ping requests

echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

The default value is 0, meaning ping replies are enabled; setting it to 1 silences all ICMP echo replies.

User management

Basic commands to inspect accounts and groups:

cat /etc/passwd        # list users
cat /etc/group          # list groups
who                     # current logged‑in users
last                    # login history

Remove unnecessary default accounts and groups to prevent brute‑force abuse:

userdel sync
userdel shutdown
# other removable users: halt, uucp, operator, games, gopher

groupdel adm
groupdel games
# other removable groups: lp, dip

Protect the critical account files by making them immutable (only root can change them):

chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/group
chattr +i /etc/gshadow

To revert, replace +i with -i and run the same commands.

Create new users

adduser username          # create a new user
passwd username           # set the user’s password

Regular users should have full permissions only within their home directories; privileged actions require sudo. The sudoers file is read‑only by default; to edit it, grant write permission temporarily:

chmod -v u+w /etc/sudoers   # allow editing
# edit the file, add the needed lines, then save and exit (wq)
chmod -v u-w /etc/sudoers   # restore read‑only mode

Grant root privileges

Method 1: Enable the wheel group in /etc/sudoers and add the user to that group.

## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
# then add the user to wheel
usermod -g wheel uusama

Method 2 (recommended): Directly add explicit entries for root and the user.

## Allow root to run any command anywhere
root ALL=(ALL) ALL
uusama ALL=(ALL) ALL

Method 3: Change the user’s UID to 0 in /etc/passwd.

uusama:x:500:500:tommy:/home/uusama:/bin/bash
# after modification
uusama:x:0:500:tommy:/home/uusama:/bin/bash

After applying any of these methods, log in with the uusama account and use su - or sudo -s to obtain root privileges.