Server Hardening: A Complete Guide to the Initial Configuration of a Dedicated Server
Usually when a new dedicated server is delivered, the basic operating system configuration is designed to ensure maximum compatibility and usability rather than maximum security. Leaving a server exposed on the internet with its default settings means making it an easy target.
The process of securing a system is called Server Hardening. In this guide, we will explore how to secure the infrastructure starting from the basics.
Server Hardening: What it is and why the CIS benchmark is the standard
Hardening is the process of reducing a system’s vulnerability to attack. It consists of disabling unnecessary services, applying the principle of least privilege, and configuring restrictive security policies.
The CIS Benchmark features guidelines developed by a global community of cybersecurity experts. Following these directives supports the technical security requirements mandated by regulations such as the GDPR and NIS2.
To facilitate hardening operations, we at Servereasy.it include free IPMI/KVM access with every dedicated server we provide. This allows you to operate securely from a remote location right from the first boot, as if you were physically in front of the machine’s console in our datacenter in Settimo Milanese.
Windows Server Hardening: Here are some checks before you begin
The Windows ecosystem requires special attention to domain policies, legacy protocols, and remote access. In fact, precisely for this reason, we always recommend testing the impact of these configurations in a staging environment before final deployment.
We recommend starting by verifying operating system updates, drivers, runtimes, and updated applications. Install only necessary components and remove unused roles, non-essential administrative tools, and unmanaged third-party software. Additionally, administrative accounts must be managed according to the principle of least privilege, meaning:
- Separating personal accounts from “privileged” ones
- Limiting the daily use of administrative accounts
- Limiting logon to authorized systems
- Using dedicated groups
- Emergency accounts must be protected, monitored, and subjected to controlled usage procedures
Another important check is to protect credentials and authentication memory. You must enable applications compatible with your role, hardware, and applications.
For example, “Credential Guard“, LSASS protection, Secure Boot, and Secured-core features. Eliminate legacy protocols and strengthen authentication. Apply network segmentation and Windows Defender Firewall (the host firewall must remain active on all profiles) and allow only necessary traffic, favoring rules based on subnets, management hosts, and applications.
One of the most important factors is to secure remote access and RDP: do not expose TCP port 3389 directly to the internet; use a VPN, RD Gateway, or ZTNA with high-level authentication and origin control. Strengthen SMB and Shares; this requires server-side and client-side SMB signing. On Windows Server 2025, outbound signing is required by default, while inbound requirements must be verified and governed through policies. You must disable SSL and TLS 1.0/1.1 only after identifying and fixing dependencies. Maintain TLS 1.2 as a minimum requirement and use TLS 1.3 on Windows Server 2022/2025.
Other checks to perform:
- Deploy antivirus, EDR (Endpoint Detection and Response), and attack surface controls
- Control application, script, and PowerShell execution
- Protect data, file systems, and configurations
- Advanced auditing, centralized logging, and alerts
- Design backup and recovery as a security control: Backups must be separated from the administrative domain, protected with MFA, and include offline copies.
You can download and consult the official document CIS Microsoft Windows Server 2025 Benchmark v2.1.0
Linux Hardening Checklist (Ubuntu/Debian)
The first step is to keep the Linux environment constantly updated to install any security fixes and known bugs. Next, you must set up user management and access control: accessing a server with the root user or with elevated privileges is not recommended, because in the event of a compromise, malicious actors could gain full access to the machine.
Modifying the sshd_config file is important because by setting PasswordAuthentication to no and PubkeyAuthentication to yes, we prevent passwords from being vulnerable to brute-force attacks. Configure fail2ban, which allows you to automatically block IPs attempting brute-force logins on SSH and web services. We at Servereasy.it suggest baseline values like bantime=3600, findtime=600, maxretry=5, to be adapted later to your specific needs.
Other fundamental steps include:
- Disable root login: By setting PermitRootLogin no in the SSH service
- Disable unnecessary services: Use systemctl disable and mask to completely block the startup of unrequested daemons (e.g., avahi-daemon, cups, bluetooth).
- GRUB Password: Protect the bootloader by running grub-mkpasswd-pbkdf2. This configuration prevents unwanted boots from live USB sticks or fraudulent alteration of boot parameters
- Firewall configuration
- Backup and Log Management
Hardening Checklist for SMEs: Here are the 10 actions recommended by Servereasy
About 9 out of 10 SMEs often lack a dedicated cybersecurity team, yet under current laws, they are held legally accountable in the event of problems. We have prepared 10 priorities based on our analyses and those derived from the CIS Benchmark.
| Priority | What we recommend doing |
|---|---|
| 1 | Disable unnecessary services such as Print Spooler, Fax, Browser, and Remote Registry on servers that do not explicitly use them. |
| 2 | Apply all security patches (Windows Update, firmware, drivers) while avoiding the accumulation of critical obsolete patches. |
| 3 | Configure Password policy via GPO: passwords must be at least 14 characters long, complex with special characters, lock out after 5 attempts, and have a recommended rotation every 90 days. |
| 4 | Disable SMBv1 and legacy protocols such as TLS 1.0 and TLS 1.1 directly from the system registry or via PowerShell. |
| 5 | Enable advanced audit policies to track Logon/Logoff, object access, policy changes, and account management. |
| 6 | Configure Windows Firewall to block all incoming traffic by default, allowing administrative access only from known IPs. |
| 7 | Enable Credential Guard: supported starting from Windows Server 2016 and later versions, it protects NTLM credentials and Kerberos tickets at the hardware level. |
| 8 | Implement native Windows LAPS to automatically generate and rotate complex, unique passwords for the local administrator. |
| 9 | Apply disk encryption with BitLocker, with a TPM 2.0 chip strongly recommended for seamless integration. |
| 10 | Document and test every single modification: always take a preliminary snapshot and prepare a quick rollback plan. |
Implementing these configurations requires advanced skills that are not always available internally within a company. In fact, for those who lack an internal IT team dedicated to security, we at Servereasy offer the Managed Server service (available upon request and quote exclusively on our services). We take care of the initial hardening, continuous updating, and proactive monitoring of your infrastructure.
To start with a solid foundation from day one, discover our Dedicated Servers and our VPS as well.
Servereasy answers:
What is the CIS Benchmark and why is it important?
The CIS (Center for Internet Security) Benchmark is an internationally recognized configuration catalog for securing IT systems. It is essential because it provides objective, documented standards that help organizations defend against threats and build a solid foundation to meet regulatory requirements.
Is having a hardware firewall sufficient to protect the server?
The firewall is essential, but it represents only the first layer of defense. If a malicious actor manages to breach the perimeter—perhaps by maliciously exploiting a legitimately open port (such as 443)—data security depends entirely on how hardened the underlying operating system is.
How long does it take to harden a dedicated server?
Manual initial configuration can take several hours. Using automation scripts or centralized GPOs reduces the time, but we always suggest allocating sufficient time to test business applications and the application of policies.
What should you do if a hardening rule blocks a business application?
During the initial phase, if a restrictive policy conflicts with an indispensable legacy software, a targeted and well-documented exception must be created. However, this exception must be accompanied by compensatory controls.
Our mission is to provide scalable, secure, and consistently reliable hosting and IT infrastructure solutions tailored to both individuals and businesses.
We believe hosting should be simple and transparent; that is why we invest in cutting-edge technologies and proprietary protection systems, ensuring performance and continuity in any situation.
With over 15 years of experience, we support our clients’ digital growth through expert assistance and constant innovation.
www.servereasy.it