Server Hardening: A Complete Guide to the Initial Configuration of a Dedicated Server
Whenever a new dedicated server is delivered, the operating system’s default configuration is designed to maximize compatibility and usability, not security. Leaving a server exposed to the internet with factory settings makes it an easy target for botnets, ransomware, and brute-force attacks.
This security process is known as Server Hardening. In this guide, we’ll break down how to lock down your infrastructure from the ground up, using the CIS Benchmark (Center for Internet Security) as our international reference – the technical standard for enterprise cybersecurity.
Server Hardening: What It Is and Why the CIS Benchmark Is the Standard
Hardening is the process of reducing a system’s attack surface. It involves disabling unnecessary services, applying the principle of least privilege, and configuring restrictive security policies.
The CIS Benchmark provides configuration guidelines developed by a global community of cybersecurity experts. Following these guidelines closely supports the technical security requirements set out by regulations like GDPR and NIS2, helping ensure the server is protected against the most common vulnerabilities and attack vectors.
At Servereasy.it, we know how delicate this initial setup phase is. That’s why we include free IPMI/KVM access with every dedicated server. This tool lets you operate securely and remotely from the very first boot, just as if you were physically standing in front of the console in our data center in Settimo Milanese, Italy.
Windows Server 2022 Hardening Checklist: 12 Practical Steps
The Windows ecosystem needs particular attention to domain policies, legacy protocols, and remote access. We always recommend testing the impact of these configurations in a staging environment before rolling them out to production.
- Step 01 – Disable SMBv1: Run the PowerShell command Set-SmbServerConfiguration -EnableSMB1Protocol $false. SMBv1 is the attack vector behind threats like WannaCry and NotPetya. No exceptions here.
- Step 02 – 14+ Character Password Policy via GPO: Set a GPO requiring a minimum of 14 characters, mandatory complexity, and account lockout after 5 failed attempts. As an operational best practice, we suggest a 90-day password expiration.
- Step 03 – Enable BitLocker on All Volumes: Use AES-256 encryption. A TPM 2.0 chip is strongly recommended for the standard configuration (though BitLocker can technically run without a TPM via GPO and a USB key – a practice we don’t recommend). Always store the recovery key in Active Directory.
- Step 04 – Configure AppLocker: Create a whitelist of authorized applications. Block executables (.exe), libraries (.dll), and unsigned scripts to prevent ransomware execution.
- Step 05 – Windows Firewall, Deny All Inbound: Block all inbound traffic by default, allowing only documented ports. RDP should be accessible exclusively from internal IPs or via a company VPN. Never expose RDP on a public IP.
- Step 06 – Advanced Audit Policies: Enable essential log categories such as Logon, Object Access, Policy Change, and Account Management. Logs should then be centralized in a SIEM.
- Step 07 – RDP with NLA (Network Level Authentication): Enforce Network Level Authentication on all RDP sessions. Set a timeout to disconnect idle sessions (e.g. 15 minutes) and limit RDP access to only the users who strictly need it.
- Step 08 – Set Up Native Windows LAPS: On Windows Server 2019, 2022, and 2025 (via the April 2023 updates), use Windows LAPS, which is natively built into the operating system. Do not use the legacy “Microsoft LAPS” MSI package, which is now officially deprecated. The new Windows LAPS encrypts passwords in Active Directory and supports password history. As an operational best practice, we recommend setting automatic rotation every 30 days.
- Step 09 – Block USB via GPO: Under Computer Config > Admin Templates > System > Removable Storage Access, enable the policies to block both read and write access across all USB device classes.
- Step 10 – Automatic Updates (WSUS/WU): Apply security patches promptly and keep your server’s firmware up to date (iDRAC, iLO, IPMI). As a recommended best practice for minimizing your exposure window, patches should be installed within 72 hours of release.
- Step 11 – Windows Event Forwarding (WEF): Centralize security logs from all servers to a dedicated collector. This step is a prerequisite for correlated event analysis.
- Step 12 – Immutable Backups: Use solutions like Veeam with immutability enabled, or WORM-type backup storage. This prevents ransomware from encrypting or deleting your backups. We strongly recommend testing restores on a monthly basis.
Linux (Ubuntu/Debian) Hardening Checklist: 10 Essential Steps
Linux servers require a precise configuration approach focused on access management and network perimeter control.
- 01. SSH Key-Only Authentication: Edit the sshd_config file, setting PasswordAuthentication no and PubkeyAuthentication yes. Passwords are vulnerable to brute-force attacks; cryptographic SSH keys offer significantly stronger protection.
- 02. Configure fail2ban: This tool automatically bans IPs attempting brute-force access on SSH and web services. As an operational best practice, we suggest starting values like bantime=3600, findtime=600, maxretry=5, then adjusting them to fit your needs.
- 03. UFW (Uncomplicated Firewall): Apply the baseline rule ufw default deny incoming, followed by ufw allow rules only for the ports you actually need (e.g. 22 for SSH, 443 for HTTPS).
- 04. Enable Unattended-Upgrades: Install the unattended-upgrades package and enable it for security updates. As a best practice, we recommend having critical security patches install automatically within 24 hours of release.
- 05. Configure auditd: Track every change to critical system files such as /etc/passwd, /etc/shadow, and /etc/sudoers, centralizing the logs. This is a key building block for meeting NIS2 requirements.
- 06. AppArmor in Enforcing Mode: Use the aa-enforce command for all supported profiles. This MAC (Mandatory Access Control) system restricts, at the kernel level, what a compromised process can actually do.
- 07. GRUB Password: Protect the bootloader by running grub-mkpasswd-pbkdf2. This prevents unwanted boots from live USB drives or fraudulent tampering with boot parameters.
- 08. Disable Root Login: Set PermitRootLogin no in the SSH service. Administrators should authenticate with named accounts and elevate privileges only when needed via sudo, ensuring full accountability for every action.
- 09. Apply CIS Benchmark Level 1: Verify compliance by scanning the system with the CIS-CAT Pro tool. Aim for a high compliance rate (ideally above 95% as a best-practice enterprise target), documenting any exceptions required for software to keep functioning.
- 10. Disable Unnecessary Services: Use systemctl disable and mask to fully stop unneeded daemons from starting (e.g. avahi-daemon, cups, bluetooth).
SME Hardening Checklist: 10 Immediate Actions (Level 1)
Small and medium-sized businesses often don’t have a team dedicated exclusively to cybersecurity, yet they need to protect their data with the same urgency as larger organizations. Here are 10 top priorities, based on CIS Benchmark Level 1.
| Priority | Strategic Action and Operational Details |
|---|---|
| 1 | Disable unnecessary services such as Print Spooler, Fax, Browser, and Remote Registry on servers that don’t explicitly use them. |
| 2 | Apply all security patches (Windows Update, firmware, drivers), avoiding any backlog of critical patches. |
| 3 | Configure Password Policy via GPO: minimum 14 characters, lockout after 5 attempts, and a recommended 90-day rotation. |
| 4 | Disable SMBv1 and legacy protocols such as TLS 1.0 and TLS 1.1 directly from the system registry or via PowerShell. |
| 5 | Enable advanced audit policies to track logon/logoff events, object access, policy changes, and account management. |
| 6 | Configure Windows Firewall to block all inbound traffic by default, allowing administrative access only from known IPs. |
| 7 | Enable Credential Guard: supported from Windows Server 2016 onward and enabled by default from Windows Server 2025, it protects NTLM credentials and Kerberos tickets at the hardware level. |
| 8 | Implement native Windows LAPS to automatically generate and rotate complex, unique passwords for the local administrator account. |
| 9 | Apply disk encryption with BitLocker, with a TPM 2.0 chip strongly recommended for smooth integration. |
| 10 | Document and test every change, always take a snapshot beforehand, and keep a quick rollback plan ready. |
We know that implementing all these configurations requires advanced systems administration skills that aren’t always available in-house. For businesses without a dedicated internal IT security team, Servereasy.it offers a Managed Server service (available on request and by quote, exclusively for our own services). We’ll take care of initial hardening, ongoing updates, and proactive monitoring of your infrastructure.
To start off on solid ground from day one, check out our Dedicated Servers and our VPS.
Servereasy answers:
What is the CIS Benchmark and why does it matter?
The CIS (Center for Internet Security) Benchmark is a globally recognized catalog of configuration best practices for securing IT systems. It matters because it provides objective, well-documented standards that help organizations defend against threats and build a solid foundation for meeting regulatory requirements.
What's the difference between Hardening Level 1 and Level 2?
CIS Benchmark Level 1 includes baseline recommendations that significantly reduce the attack surface without severely restricting server operability. Level 2 (Defense-in-Depth) is designed for high-security environments and can introduce functional limitations if applied without careful testing.
Is a hardware firewall enough to protect the server?
Absolutely not. The perimeter firewall is essential, but it’s only the first layer of defense. If an attacker manages to breach the perimeter – for instance, by exploiting a legitimately open port like 443 – your data’s security then depends entirely on how hardened the underlying operating system is.
How long does it take to harden a dedicated server?
Manual initial configuration can take several hours. Using automation scripts or centralized GPOs speeds up deployment, but we always recommend allowing enough time to thoroughly test business applications after applying the policies.
What if a hardening rule breaks a business application?
During the preliminary testing phase, if a restrictive policy conflicts with essential legacy software, you’ll need to create a targeted, well-documented exception. That exception should be paired with compensating controls (for example, if a legacy service can’t be disabled, access to it should be restricted at the firewall level to a single authorized machine).
Our mission is to provide scalable, secure, and consistently reliable hosting and IT infrastructure solutions tailored to both individuals and businesses.
We believe hosting should be simple and transparent; that is why we invest in cutting-edge technologies and proprietary protection systems, ensuring performance and continuity in any situation.
With over 15 years of experience, we support our clients’ digital growth through expert assistance and constant innovation.
www.servereasy.it