5 Easy Tweaks to increase your Linux Server's Security

In the second episode of my Enterprise Linux Security series, I'll show you 5 easy tweaks you can make to enhance the security of your Linux server. Ubuntu Server will be shown as the example distribution, but most of these tweaks can be done on any distro with some modifications to the syntax as necessary.

Time Codes:
00:00 - Intro
03:27 - Tweak 1: Adding a non-root user
08:06 - Tweak 2: Install updates
10:47 - Tweak 3: Setting up unattended-upgrades
20:31 - Tweak 4: Locking down Openssh
32:26 - Tweak 5: Installing Fail2ban

# LearnLinuxTV Links
🐧 Main site:

🐧 LearnLinuxTV Community:

# Support LearnLinuxTV (commission earned)
📖 Check out Jay's latest book, Mastering Ubuntu Server 4th Edition. Covers Ubuntu 22.04!

☁️ Support LearnLinuxTV and Set up your own cloud server with Akamai Connected Cloud:

🙌 Support me on Patreon and get early access to new content!

☁️ Check out Extended Lifecycle Support to keep your end-of-life distributions supported for a longer period of time:

🛒 Affiliate store for Linux compatible hardware/accessories (commission earned):

💻 Check out the Tiny Pilot KVM for your Homelab (commission earned):

# About Me
🐦 Follow me on Twitter!

👨 More about me:

# Recommended evergreen videos:
💽 How to create a bootable flash drive for installing Linux

🐧 OpenSSH Guide

📖 LVM Deep-dive:

🔐 How to better secure OpenSSH:

☁️ How to create a cloud Linux server with Linode:

*📘 FAQ*

#Server #Linux #Security

[nightmarenova]

Great video Jay, i think this should be somewhat of a series if possible "Securing Linux servers 101"

[TheBlues]

Great video as always. It is amazing the amount of information you are able to deliver on the topics and surrounding the topics on such a clear manner.

For the same reason, to me, the third edition of your book "mastering ubuntu server" is a master piece.

[camerontgore]

Love the security content! Keep it coming!

[cstephan]

Back on track again :) Thanks for all that you do, Jay.

[grahammccann]

Hi Jay, Thank you for the video, very helpful.

[jamiej.]

Good info. Thanks Jay!! If u get a chance i would love to see a video showing how to manually set up an open lightspeed server with wordpress and SSL config.

[FedecraftITALIA]

5 easy tweaks, 40 minutes long video 😵
JK, now I will watch it.

[MrPDC-jryl]

Super video Jay. Is there an ansible playbook for this? :) Also, do you create a separate sudo user for ansible commands or same non-root user can be used? as well separate key for this without a pass?

[unbekannter_Nutzer]

7:00 I doubt `sudo ls /etc` is a good command, to test, whether the sudo command works, since normally, you can do `ls /etc` without sudo with the same result. `sudo ls /etc/ssl/*` would be fine, which normally gives you a mixed output of files you are allowed to see and an error message for /etc/ssl/private.

Imho it is a bad practice, to constantly clear the screen while teaching. I'm often still reading in the output or the last command. At 9:40 for instance, you clear the screen and talk until 10:15, without typing anything at the prompt. If you do a double enter when starting a new point, it is easy to follow and to find the breaks while being able to read commands and output and think about them.

[MaxCohen]

Hi, Jay. What is the music on chapter changing?

[chillpill]

Wonderful video as usual brother, thanks a lot for ur rfforts & work. I m ew to linux, request you to pleaase make such tweaks & security things for desktop distros too. I m on LinuxMint 21.3 Cinemon. Really appreciate u, thanks once again. TC.

[ziggyspaz]

This video is geared towards linux distros that use `apt`

[hoterychannel]

if sudo still can be considered secure and more, recommended fo use? And if we going to use sudo, we can disable root account completely. or use “su” and have separate password (for root user)?
Dont understand, if we can add our ip (or ip range) in ignoreip in fail2ban, why we cant just allow only that ips with firewall?

[vordreller]

Personally I'd advise against unattended upgrades. Don't want an upgrade to docker being installed on a live system, potentially restarting all containers. At the very least, specific packages should be put on hold when they're operation critical and cannot be restarted under normal circumstances.

[JeanPaulB]

Question: isn't the 'ignoreip' option in fail2ban irrelevant if we're using a public key to access the server?

[Bluelight]

Is this way of connecting to servers on by default if you install a Linux Mint server at home to connect to? I would prefer to only allow LAN connections.

[ryanbell]

Can you prevent your SSH passphrase from being cached?

[SkyFly]

Thanks for this tutorial!

Btw, can these tweaks be used for Linux Desktop environment?

[n.aminr.]

Can I enable VPN on my router to my server? Is this possible?

[MorphicStates]

supersecure as a password? I like it. ;-)