Our first production server had a root password, password SSH, and a database port open to the internet. It survived four days before we knew better. The scanner found it in under six hours.
I know because we checked the logs after hardening: the brute-force attempts started the same day the IP went public. Hundreds a day. None of them sophisticated. All of them would have kept running forever if the password had been weak enough — and at a two-person company, the password was "the founder's usual one, with a 1 on the end."
We didn't buy a security tool to fix this. We spent an afternoon. Here's the ten-control list that stopped the noise, sized for teams with 1–10 servers and no security engineer.
The ten controls
1. SSH keys only, no passwords, no root login. PasswordAuthentication no, PermitRootLogin no, reload sshd — but verify your key works before closing the current session. After we did this, /var/log/auth.log went from hundreds of lines a day to zero. The background noise simply has nothing to push against.
2. Firewall: default deny, allow only what's public. 22/80/443 in, everything else out, admin ports restricted to your own IP. Every database, cache, and panel stays unreachable. "The port has a password" is not a defense — scanners find exposed ports within hours.
3. Security patches on autopilot. unattended-upgrades with the -security origin on. You still review weekly, but CVEs with public exploits should not wait for your monthly patch window.
4. Fail2ban on SSH. You've already disabled passwords (control 1), but it catches brute-force on any admin surface you expose later, for five minutes of setup.
5. Least-privilege service users. Nothing internet-facing runs as root or a personal account. One user per service, no shell, no shared logins. When you read logs later, "which user did this" needs a one-word answer.
6. 2FA everywhere a human logs in. Hosting console, registrar, DNS, cloud dashboard. The most common small-team breach isn't the server — it's the control plane: a phished hosting password, a hijacked domain. Your server is only as hard as the console that controls it.
7. Backups that are tested and off-box. Encrypted, off-site, versioned, restored in a drill. The hardening checklist that ignores ransomware is a checklist about the last decade. Our restore drill is 20 minutes — and it found a DR bucket in the same region as production.
8. Uninstall what you don't run. Every installed package is future CVE homework. If nobody can say what a service is for, it goes.
9. Logging that survives the incident. Ship auth and app logs off-box, even a nightly copy to object storage. Local-only logs die with the box — exactly when you need them.
10. Expiry watch: certs, domains, cards. An expired certificate takes you down with no attacker involved. It's monitoring, not security, and it belongs on both lists.
What to skip (for now)
SELinux tuning, WAFs, SOC tooling, zero-trust mesh. All real, all later. A team with default-deny, key-only SSH, automatic security patches, tested backups, and 2FA on the control plane is harder to breach than the median company that buys those tools. The gap between "hardened enough" and "compromised" is almost always an unpatched CVE, a reused password, or an exposed panel — not a missing advanced feature.
The 30-minute first-server card
New box: create your user, paste your key, disable password/root SSH, enable default-deny, install unattended-upgrades + fail2ban, create the service user, set the off-box backup, add the box to the expiry watch. Ten minutes. Every future server starts from safe instead of from "we'll harden it later" — because the scanner's clock starts in hours, and "later" never comes.
The free version
The full checklist — the ten controls with commands, the first-server card, the skip list — is on our ops notes site, next to the patch management and backup restore drills it plugs into.
If you'd rather have the whole pack: the Ops Starter Kit Vol. 2 ($27) includes the hardening checklist, the first-server card, and the patch log template, plus the advanced incident response and continuity kits. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.
And for the parts that should never depend on a human remembering: security patches on schedule, nightly off-box backups, log shipping — the Automation Starter Pack ($19) covers the pick-first workflows that make hardening permanent.
Top comments (0)