5 Steps to Secure Linux (protect from hackers)

NetworkChuck Technology Careers Career & Money

About this video

A beginner-friendly hardening walkthrough for a Linux server, demonstrated on a fresh Debian 10 virtual machine spun up on the sponsor Linode — he notes new users get a $100 credit and that the cheapest plan he picks costs $5 a month. Step one is patching: after showing manual apt update and apt upgrade, he installs and configures the unattended-upgrades package so stable security updates are downloaded and installed automatically, since unpatched servers are, in his framing, how most compromises happen. Step two is to stop logging in as root: he creates a regular user, adds that user to the sudo group, and demonstrates how sudo grants root power for a single command. Step three replaces passwords with SSH keys — he prepares the server’s .ssh directory with restrictive permissions, generates a 4096-bit key pair on his own machine, and copies the public key to the server’s authorized_keys file (using scp on Windows and ssh-copy-id on Linux, with macOS nearly identical), then logs in without a password. Step four locks down the SSH daemon’s configuration file: he moves SSH to a custom high port (717 in his example), restricts it to IPv4, sets PermitRootLogin to no, disables password authentication entirely, restarts the service, and tests the new settings from a second terminal before logging out. Step five installs the UFW firewall, allows only the custom SSH port before enabling it, shows how to open additional ports such as 80 for a web server, and edits UFW’s before-rules file to block ping responses so the server stops announcing itself. He closes with the caveat that nothing is unhackable — these are best practices, not guarantees.

Key takeaways

Enable automatic security updates with the unattended-upgrades package; forgotten manual patching is the most common way servers get compromised
Never log in as root over SSH — create a personal account in the sudo group and elevate only per command
Replace SSH passwords with a key pair (4096-bit in his example): keep the private key on your machine, put only the public key in authorized_keys on the server
In sshd_config, disable root login and password authentication and move SSH off port 22 to a custom port, then test from a second session before closing your working one
Enable UFW only after allowing your SSH port, open extra ports deliberately as services need them, and optionally block ICMP ping replies to reduce visibility

Episode details: published March 18, 2021 · 23:15 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: why Power over Ethernet (PoE) is amazing!! // FREE CCNA // EP 12 · Next: Linux for Hackers // EP 1 (FREE Linux course for beginners) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube