four boring settings that stop most linux compromises

nobody breaks in with a zero day, they walk through an open door

most linux compromises are not clever. they are boring. someone left ssh wide open to brute force, a package went unpatched for eight months, and when something did go wrong there were no logs to figure out what happened. the fix for most of this is also boring, which is the whole point. four settings, set once, and you have closed off the majority of ways real-world attackers get onto a linux box.

automatic security patches

most compromises start with a known vulnerability that already had a patch available. the gap between "patch exists" and "patch applied" is where attackers live. on debian and ubuntu systems you close that gap with unattended-upgrades, which pulls down security updates automatically instead of waiting for you to remember.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

that installs the package and walks you through enabling it. check /etc/apt/apt.conf.d/50unattended-upgrades to confirm it is only pulling security updates by default, since some setups also want to apply general updates and that is a judgement call based on how stable you need things to be. either way, the goal is the same: your server should not be sitting there vulnerable to something that got fixed months ago just because nobody logged in to run apt upgrade.

a default-deny firewall

every port that is open and not doing anything is a port someone can poke at. ufw (uncomplicated firewall) lets you flip the default so that nothing gets in unless you explicitly allow it.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

read that carefully before you run it. default deny incoming means everything is blocked unless you add a rule. allow ssh keeps you from locking yourself out if you are connected over ssh right now, which is the classic way people accidentally brick their own access. after that, only open what you actually use, web ports if you are running a web server, and nothing else. every extra open port is attack surface you are maintaining for no reason.

audit logging so you actually know what happened

a firewall and patches reduce how often something goes wrong. auditd is for when it does anyway. it logs system level events, file access, command execution, privilege changes, in a way that is much harder to quietly erase than your shell history. without it, an incident turns into guesswork. with it, you have a timeline.

sudo apt install auditd
sudo systemctl enable --now auditd

out of the box it gives you baseline logging. if you want to get specific, auditd supports rules that watch particular files or directories, like /etc/passwd or your ssh config, so you get an alert style trail any time something touches them. the point of audit logging is not paranoia, it is being able to answer "what actually happened" instead of shrugging.

fail2ban for the automated stuff

most attacks against ssh are not a person typing passwords, they are a script trying thousands of combinations a minute. fail2ban watches your auth logs and temporarily bans ip addresses after a set number of failed attempts.

sudo apt install fail2ban
sudo systemctl enable --now fail2ban

the default jail for ssh works fine as a starting point, and you can tune ban times and retry thresholds in /etc/fail2ban/jail.local without touching the main config file, which is the version that survives updates. this will not stop a targeted attacker, but it wipes out the constant background noise of automated brute force attempts that would otherwise eventually get lucky against a weak password.

the takeaway

none of these four things are exciting. that is exactly why most people skip them and exactly why they work. patching closes known holes, the firewall shrinks what is even reachable, auditd gives you a record when you need to reconstruct events, and fail2ban kills off the automated noise trying your ssh port all day. set these four up once on every server you run, check them occasionally to make sure they are still active, and you have knocked out the majority of how real linux boxes actually get compromised. it is not glamorous work, it is just the work that matters.