Linux Server Security Hardening Guide for Hosting Clients

Securing a Linux server is not a one-time task — it is an ongoing process. Whether you are managing a cPanel shared hosting account, a KVM VPS, or a bare-metal dedicated server, the attack surface is the same: SSH brute force, outdated software, misconfigured services, and weak passwords. This guide covers the most impactful steps you can take to dramatically reduce your server's exposure, ordered from the highest to lowest priority.

1. SSH Hardening — Your First Line of Defence

SSH is the primary access method for Linux servers and the most commonly attacked service. Default SSH configuration is permissive by design — you need to lock it down.

1.1 Create a Non-Root Admin User

Never operate as root directly. Create a dedicated user with sudo privileges, then disable root SSH login entirely.

1.2 Disable Root SSH Login & Change the Default Port

Edit your SSH daemon configuration file:

Change or add the following directives:

Restart SSH to apply changes. Do NOT close your current session until you verify you can log in with the new port and user.

1.3 Use SSH Key Authentication (Recommended)

Password authentication can be brute-forced. SSH keys use cryptographic key pairs that are practically impossible to crack.

Once you confirm key-based login works, you can disable password authentication in sshd_config as shown above.

2. Firewall Configuration with firewalld or CSF

A firewall is non-negotiable. It restricts incoming and outgoing traffic to only what is explicitly needed.

2.1 Using firewalld (AlmaLinux / Rocky Linux)

2.2 Using CSF (ConfigServer Security & Firewall) — Recommended for cPanel

CSF is the most popular firewall solution for cPanel/WHM servers. It integrates directly into WHM and provides a GUI for managing rules.

3. Fail2Ban — Automatic Brute-Force Protection

Fail2Ban monitors log files and automatically bans IP addresses that show malicious signs (too many failed login attempts) using firewall rules.

Key settings to configure in jail.local:

4. Automatic Security Updates

Unpatched software is the most common cause of server compromises. Enable automatic security updates to ensure kernel patches and package updates are applied without delay.

4.1 Enable dnf-automatic (AlmaLinux / Rocky)

4.2 Keep cPanel Updated

In WHM, go to Server Configuration → Update Preferences and set your cPanel tier to RELEASE or STABLE and enable automatic updates. Never run outdated cPanel versions — security patches are released regularly.

5. ModSecurity — Web Application Firewall (WAF)

ModSecurity is an Apache/Nginx module that acts as a Web Application Firewall (WAF), blocking common web-layer attacks including SQL injection, cross-site scripting (XSS), and file inclusion attacks.

5.1 Enable ModSecurity in cPanel WHM

In WHM, navigate to Security Center → ModSecurity Tools. Enable ModSecurity and install the OWASP Core Rule Set (CRS) or Comodo WAF Rules (both free). Set your initial mode to Detection Only to review what would be blocked before enforcing.

6. User Isolation with CloudLinux & CageFS

On shared hosting servers, user isolation is critical. Without it, one compromised cPanel account can potentially read files from other accounts on the same server.

CloudLinux solves this with two technologies:

• CageFS: Each cPanel user gets their own isolated virtual file system. They cannot see other users' files, running processes, or system configuration details.
• LVE (Lightweight Virtual Environment): Per-account CPU and RAM limits prevent a single account from consuming all server resources (the "noisy neighbour" problem).

WebsNP's shared hosting and reseller hosting infrastructure already runs CloudLinux with CageFS enabled by default, protecting all accounts.

7. Imunify360 — AI-Powered Malware Detection

For cPanel servers, Imunify360 by CloudLinux is the gold standard for malware detection and removal. It combines a WAF, malware scanner, patch management, and reputation-based network protection into a single suite.

• Real-time scanning of all PHP, JavaScript, and other web files for malicious patterns
• Automatic malware removal and quarantine
• Proactive Defense™ — blocks attacks in real time by monitoring PHP code execution behaviour
• KernelCare integration for live kernel patching (no reboots required for kernel updates)

All WebsNP managed dedicated server plans include Imunify360 as part of the management package.

8. Backups — Your Last Line of Defence

Even with perfect security, backups are essential. Ransomware, accidental deletion, and software bugs can all cause data loss. A backup you have not tested is not a backup.

Best Practices for Server Backups

• Follow the 3-2-1 rule: 3 copies of data, on 2 different media types, with 1 copy offsite.
• Use cPanel Backup Manager: Configure daily incremental backups to a remote FTP server or Amazon S3 bucket. Never store backups on the same server.
• Test restores monthly: A backup that cannot be restored is worthless. Schedule monthly test restores of a sample site or database.
• Retain at least 30 days: Some malware lies dormant for weeks before activating. A 7-day retention window may not be enough.

WebsNP Technical Team

This guide is maintained by the WebsNP server administration team. Our engineers manage hundreds of Linux servers running cPanel, Plesk, and custom configurations across our global infrastructure. Last reviewed April 2026. For server-specific security consultations, open a ticket in your client area.