This is close to the actual checklist we run through on a fresh Rocky Linux box before it goes into a managed-hosting rotation. It's not exhaustive — compliance-driven environments need more — but it covers the gaps that actually get exploited.
1. Update, then set up automatic security patching
sudo dnf update -y
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer2. Create a non-root sudo user, disable root SSH login
Every session as root is a session where one mistyped command has no safety margin. Create a named user with sudo, then in /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication noKey-based auth only. Password auth over SSH is the single most common thing we find still enabled on servers we inherit from another provider.
3. Firewall — default deny, allow only what's needed
sudo firewall-cmd --set-default-zone=drop
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload4. fail2ban for SSH
Rate-limits brute-force attempts against SSH automatically. Cheap to set up, meaningfully cuts noise in your auth logs.
5. SELinux stays enforcing
setenforce 0 is not a fix, it's deferring the problem. If something's blocked by SELinux, find the actual policy that needs adjusting (audit2allow is your friend) rather than turning it off.
6. Centralised logging and monitoring, from day one
Ship logs off the box before you need them for an incident, not after. A server that only has local logs is a server where the evidence disappears if the disk fills or the box gets compromised.
What we add on top of this
For clients under a managed-hosting retainer, this baseline is the starting point, not the finish line — it's paired with scheduled patch windows, uptime monitoring with real alerting, and backup verification (a backup nobody's tested restoring isn't a backup, it's a hope).