Executive Summary: Step-by-step guide to securing production Linux servers, configuring UFW firewalls, fail2ban, SSH key authentication, and Nginx reverse proxies.

Deploying web applications directly onto unhardened cloud servers exposes them to automated botnet scanners, SSH brute-force attacks, and DDoS attempts.

1. Essential Linux Hardening Checklist


1. Disable Root SSH Login & Password Auth: Require SSH key pairs (Ed25519) and enforce custom SSH ports.
2. Configure UFW Firewall: Close all inbound ports except 22 (SSH), 80 (HTTP), and 443 (HTTPS).
3. Install Fail2Ban: Automatically block IP addresses displaying malicious SSH connection behavior.
4. Automatic Security Patches: Enable unattended-upgrades for OS kernel and security updates.

2. Production Nginx Reverse Proxy Configuration


Nginx acts as the front-line shield for application servers (PHP-FPM / Node.js). Key configuration directives:

server {

    listen 443 ssl http2;

    server_name example.com;



    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;



    # Security Headers

    add_header X-Frame-Options "SAMEORIGIN";

    add_header X-XSS-Protection "1; mode=block";

    add_header X-Content-Type-Options "nosniff";



    location / {

        proxy_pass http://127.0.0.1:3000;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    }

}