Guides

For the Linux servers you run yourself: what really protects them, how to check it from outside, and how to fix it without locking yourself out.

Start here

• The server security checklistA plain checklist for the Linux server you run yourself: SSH, firewall, updates, exposed databases, users, backups and logs, each with the guide that does it.30 October 2026

SSH

• Change the SSH portIs moving SSH off port 22 worth it? What it does and doesn't do, the safe order (firewall first), and why Ubuntu 24.04 needs ssh.socket restarted too.30 October 2026
• Disable SSH password authenticationYou set PasswordAuthentication no and passwords still work. Why a cloud-init drop-in beats sshd_config, how to check the real value with sshd -T, and the fix.30 October 2026
• Fail2ban for SSHInstall fail2ban, put your settings in jail.local, read SSH failures from the journal, whitelist your own address, and know what it doesn't protect you from.30 October 2026
• Harden SSH without locking yourself outTurn on keys-only SSH, turn off root login and set sane limits without losing access: a second session, sshd -t, reload vs restart, and a way back in.30 October 2026
• SSH keys with ed25519Make an ed25519 SSH key, install it with ssh-copy-id, set authorized_keys permissions, use a passphrase with ssh-agent, and remove keys you no longer trust.30 October 2026

Firewall

• Docker bypasses UFWUFW says the port is closed, but the internet still reaches your container. Why Docker's iptables rules skip UFW, how to check from outside, and three ways to fix it.26 October 2026
• Check which ports are really openSee what really listens on a Linux server with ss -tulpn, tell 0.0.0.0 from 127.0.0.1, and confirm from outside with nmap. Why checks from the server mislead.30 October 2026
• UFW, iptables and nftablesHow UFW, iptables, iptables-nft and nftables fit together on Ubuntu and Debian, how to see the real ruleset with nft list ruleset, and why mixing tools hurts.30 October 2026
• Locked out after ufw enableSSH stopped working after ufw enable or an SSH port change. Get back in through your provider's console, fix or disable the rule, and set up an undo timer.30 October 2026
• Set up UFW without losing SSHTurn on UFW on a fresh Ubuntu or Debian server the safe way: allow SSH first, deny incoming by default, check the rules, keep IPv6 covered, rate-limit SSH.30 October 2026

Updates

• apt upgrade vs full-upgradeThe difference between apt update, upgrade, full-upgrade and dist-upgrade, why packages are kept back, phased updates on Ubuntu, and checks for a live server.30 October 2026
• Does it need a reboot?How to tell if a Linux server needs a reboot or a service restart after updates: the reboot-required file, needrestart, the running kernel, and safe restarts.30 October 2026
• Ubuntu end of lifeCheck whether your Ubuntu server still gets security updates, what standard support and ESM mean, and how to upgrade to the next LTS with do-release-upgrade.30 October 2026
• Automatic security updatesTurn on automatic security updates on Ubuntu and Debian with unattended-upgrades: the two config files, what it installs by default, dry run, logs and reboots.30 October 2026

Databases

• Exposed MongoDBOpen MongoDB servers have been wiped and held for ransom for years. Check it from outside, set bindIp, create an admin user, then enable security.authorization.30 October 2026
• MySQL bind-addressIs MySQL or MariaDB listening on every interface? Find bind-address in the Debian/Ubuntu config, fix users with host '%', drop anonymous users, use a tunnel.30 October 2026
• Is your PostgreSQL exposed?How to tell if anyone on the internet can reach your PostgreSQL: listen_addresses, pg_hba.conf host lines, trust and md5 vs scram-sha-256, Docker, SSH tunnels.30 October 2026
• Exposed RedisAn open Redis can lose all its data to one command or give an attacker a way onto the server. How to check it, then bind, protected-mode, ACL users, Docker.30 October 2026

Platforms

• Coolify ports and securityWhat a self-hosted Coolify server exposes on 8000, 6001 and 6002, why UFW doesn't block Docker ports, and how to move the dashboard behind a domain with HTTPS.30 October 2026
• Securing Portainer CESecuring Portainer CE on a server: what 9443, 8000 and 9001 do, the 5-minute setup window, keeping the Docker socket and agent off the internet, and HTTPS.30 October 2026

Users

• Safe changes on a shared serverBefore you harden SSH or the firewall on a server others use: find who logs in and how, why disabling passwords can lock out teammates, and Match rules.30 October 2026
• Use a sudo user instead of rootStop logging in as root: create a sudo user on Ubuntu or Debian, copy your SSH key to it, test it in a second session, then set PermitRootLogin no safely.30 October 2026

Backups

• Database backups before changesQuick, correct backups before you touch a database: pg_dump and pg_dumpall, mysqldump --single-transaction, Redis RDB copies, mongodump, and how to test them.30 October 2026
• Snapshot before you change thingsBefore an upgrade or config change, make a restore point: a provider snapshot, an LVM snapshot, a copy of /etc or etckeeper. Then check that you can restore it.30 October 2026

Monitoring

• Who tried to log in over SSHFind failed and successful SSH logins with journalctl, auth.log, last and lastb, count attempts per address, and tell background noise from real trouble.30 October 2026
• Check when a certificate expiresCheck a TLS certificate's expiry date with openssl, list certbot's certificates, test renewal with a dry run, and get ready for shorter Let's Encrypt lifetimes.30 October 2026