# Server security and hardening — a locked-down Linux host | RootCore LLC

> Server hardening step by step — firewall, SSH hardening, kernel-level protection, IDS/IPS, logging and automated updates. We start with a free assessment.

Page: https://cyber-security.rootcr.com/en/server-security/
Updated: 2026-08-20

---

# Server protection and hardening

> **In short:** Server hardening is the work that moves a host from its default state into a defended one: unnecessary services are closed, login becomes key-based, the firewall gets a real rule set, intrusion detection raises alarms, and logs stay searchable. RootCore starts with an assessment and ends with a written report.

## What does server hardening mean?

A freshly installed host is open: it runs a few services nobody needs, password login still works, the firewall is permissive and logging is shallow. That default state can survive for years — until someone finds it. And today it is not a person who finds it, it is software.

Hardening replaces that default state. It is not a single setting but a series of layers: each one is an obstacle on its own, and together they make an attack disproportionately expensive.

## What exactly do we do?

| Layer | What we do | What it protects against |
|---|---|---|
| Access | Key-based SSH, password login disabled, admin ports restricted | Brute force and leaked passwords |
| Firewall | Deny-by-default rule set, only the required ports, rate limiting | Port scanning, service exhaustion |
| Services | Unnecessary packages and daemons removed, privileges narrowed | The size of the attack surface |
| Kernel | Kernel-level hardening, mandatory access control | Privilege escalation through a known bug |
| Detection | Intrusion detection (IDS/IPS), file integrity monitoring | Quiet, long-term presence |
| Updates | Automated security updates with a controlled reboot schedule | Already known, already patched flaws |
| Logging | Central, searchable logging with an alerting chain | Being able to investigate after an incident |

## How do I know I need this?

A few signs that usually justify a look at the host:

- the server still accepts password login, and you cannot say who has access;
- no updates have run for months — or they run, but nobody reads what happened;
- old test or development environments sit on the same machine as the live site;
- there was a “the server is slow” period that turned out not to be caused by traffic;
- you do not know where the logs are or how long they are kept.

## How does the work run?

1. **Assessment.** We look at the machine from the outside and the inside: open ports, running services, versions, access, logging. This part is free, and you get a summary of what we found.
2. **Plan.** A prioritised list: what is critical, what is important, what can wait. For every item we write down what it protects and what the risk of the change is.
3. **Implementation.** Hardening step by step, in a reversible way. The service keeps running; where downtime is unavoidable, we agree on the window in advance.
4. **Verification.** A retest after the fixes and a written record of what changed.

## How long does it take?

Hardening a typical single-server website or shop takes a few working days. For environments with several machines, databases and background services we give a deadline after the assessment — we do not invent numbers up front.

## Frequently asked questions

### Does my hosting provider not handle this?

No. A hosting provider supplies the infrastructure: the hardware, the network, the power. What runs on the server — the operating system configuration, the services, the permissions, the updates — is yours. With a managed plan there can be overlap, but the contract decides the details; it is worth reading what the provider does and does not take on.

### Will my website go down during hardening?

Most of the work can be done without downtime. Where a restart is unavoidable — a kernel update, for example — we do it in an agreed window, and it usually means minutes.

### What if something breaks after the changes?

Every change is preceded by a backup, and the steps are reversible. After hardening we retest, and the report lists what changed — so whoever touches the system later can see it too.

### Do you work with Windows servers?

Our primary ground is Linux. In a Windows environment we take on the assessment and the access and network security work; if deeper, domain-level work is needed, we say so up front.

### Is this a one-off job?

Hardening is a one-off project, but staying protected is maintenance: new vulnerabilities appear and systems change. That is why we recommend [continuous monitoring](/en/ai-watchdog/) alongside it — although it is not a condition for doing the hardening.