SSH hardening
Key-based access, no password login where appropriate, a restricted admin path.
Server Security & Hardening
Less exposure, controlled login, current software, backups that restore. Hardening lowers risk; it does not remove it.
The hardening job
Close the obvious doors. Do not pretend the host is invulnerable.
Operational hardening on machines you already own — not a firewall product, not a pentest, not a vendor partnership.
- ExposureOnly the ports you intend
- Access pathSSH, firewall, TLS
- People and keysWho may log in, and how
- CurrencyPatches you can actually apply
- RecoveryBackups that restore
Typical controls
Work we usually discuss, then apply to this host
Host firewall
Allow what the app needs. Do not leave management ports open to the internet.
Access control
Named users, sudo policy, and leftover accounts from previous agencies gone.
Patch management
A cadence that matches restart tolerance.
Exposure review
What is listening, what DNS publishes, and what should not.
TLS
Current certificates, sensible protocols, renewal that does not surprise you.
Malware investigation
If already compromised, the honest path is often rebuild, not “clean in place”.
Backup strategy
What is copied, and a restore test — not only a nightly job never tried.
Use cases
- A VPS that was opened with defaults and has been on the internet since
- A host that several contractors have logged into
- A new deployment that should not copy weak settings from the old one
What this page is not
- Not a guarantee against breach.
- Not an ADGLOB-branded appliance you have to buy.
- Not a substitute for application security review unless that is scoped separately.
Related pages
Show us what the internet can already reach
Bring the host, how people log in today, and whether backups have ever been restored.
FAQ
Common questions
Will this make the server completely secure?
No. Hardening lowers exposure and improves controls. Residual risk remains, and no engagement can promise a server is fully secure.
Do you sell a branded firewall product?
We harden the host using appropriate firewalling, SSH controls and TLS. Tooling is chosen for the environment rather than sold as an ADGLOB-branded appliance.
Is this a penetration test?
No. This page is host hardening and operational practice. A separate security assessment can be discussed if you need that style of review; it is not assumed here.
What about malware?
If a host is already compromised, the work is investigation and recovery, which may mean rebuild rather than 'cleaning in place'. Hardening is most effective before that happens.