Linux Server Hardening 2026 – secure Debian 13 properly

A Debian server does not need to be complicated to secure, but the order matters. This guide covers SSH, firewalls, updates, Fail2ban, AppArmor, TLS, logging and monitoring.

Minimal installation

Install only required services. Every network-facing service increases attack surface.

Secure SSH

Prefer keys, disable root login, remove unnecessary authentication methods and restrict access through a firewall or VPN where possible.

ss -tulpn
systemctl --type=service --state=running
ufw status verbose

Firewall

Use a clear default-deny policy and expose only required ports.

Updates

Security updates need a predictable process. Automatic updates can help but should fit maintenance windows and monitoring.

Fail2ban and sshguard

Both can mitigate certain brute-force patterns. Neither replaces strong authentication or a firewall.

AppArmor

AppArmor can restrict processes further. Review profiles and enable them deliberately.

TLS

Use modern TLS for web services and monitor certificate expiration.

Logging

Journald and rsyslog provide valuable evidence, but logs also require storage and privacy planning.

auditd

For sensitive systems, auditd can improve accountability. Use focused rules rather than logging everything.

Monitoring

A server checked only after a user reports a problem is not monitored. Availability, resources and service health belong together.

Hardening checklist

Review SSH, firewall, updates, services, users, sudo, TLS, logs, AppArmor, time, DNS and backups.

Conclusion

Hardening is an ongoing operating process, not a one-time configuration.