Server security checklist (printable) for Linux and Unix
Print this page and keep it next to your desk. Each line is one task; the link goes to the guide that explains how to do it. Adapt the intervals to your setup, but do not skip a whole group.
How to use it. Tick items as you go and keep the dated sheet. A stack of filled-in checklists is a simple record that patching actually happened. Unknown terms are explained in the glossary.
Daily
- Read new security advisories for your operating system and main software. Where to subscribe
- Check new critical CVEs and new CISA KEV entries against what you run. Current vulnerabilities
- Confirm automatic security updates ran without errors. Automatic updates
- Review login alerts: new SSH logins, sudo use, spikes in failed logins. Login alerts
- Glance at monitoring: disk space, load, unknown processes, unexpected outbound connections. Logging and monitoring, Process and network watch
- Confirm last night’s backups finished. Ransomware-proof backups
Weekly
- Install pending updates on hosts without automatic updates, in your maintenance window. Update schedules
- List hosts that need a service restart or reboot and schedule them. Restarts and reboots
- Run a vulnerability scan and work through new findings (check for backported fixes first). Vulnerability scanning, Check installed versions
- Review file integrity alerts for changed binaries, configs and web files. File integrity monitoring
- Review web server logs and WAF events for attack patterns. Web attack monitoring
- Update web applications, plugins and themes (WordPress, Joomla, Drupal and similar). WordPress, Joomla and Drupal
- Rebuild container images on patched base images and redeploy. Containers
Monthly
- Reboot into the newest kernel, or confirm live patches are applied and a reboot is planned. Reboots the server. Kernel updates, Kernel live patching
- Restore one backup to a test location and check the data. Restore from backup
- Review user accounts, SSH authorized_keys and sudo rights; remove anything unused. SSH hardening
- Compare firewall rules and listening ports with what should be open. Firewall basics
- Check end-of-life dates for the OS and runtimes such as PHP and Node.js. Is my OS supported?, Updating PHP, Updating Node.js
- Check TLS certificate expiry dates and that renewal works. SSL certificate expired
- Check your server IPs against public blocklists. IP blacklisted / spam
After every critical CVE
- Triage: do you run it, is it reachable from the internet, is it in KEV, what is its EPSS score? Emergency patching
- Find every affected host and package version, allowing for backported fixes. Check installed versions
- Take a snapshot or backup before changing anything. Ransomware-proof backups
- Patch internet-facing hosts first, then internal ones. Emergency patching
- Restart the affected services, or reboot / live-patch for a kernel fix. Restarts services or reboots. Restarts and reboots
- Verify the fixed version is installed and the running processes use it. Check installed versions
- No fix yet: reduce exposure (disable the feature, restrict access with the firewall, add a WAF rule). Firewall basics
- If the flaw was exploited before you patched, look for signs of compromise. Signs of compromise
- Found something? Switch to incident response; patching alone will not remove an intruder. Incident response
Before going live
- OS release is supported, with at least a year of security fixes left. Is my OS supported?, Distributions and versions
- All updates installed and the server rebooted onto the newest kernel. Reboots the server. Kernel updates
- Automatic security updates enabled and tested. Automatic updates
- SSH: key-only logins, no direct root login with a password. SSH hardening
- Firewall blocks all inbound traffic except the services you offer. Firewall basics
- Unneeded packages and services removed; hardening baseline applied. Server hardening
- Web server and application stack configured securely. nginx, Apache, OpenSSL
- Logs sent off the server; monitoring and login alerts working. Logging and monitoring, Login alerts
- Intrusion detection and file integrity baseline recorded. Intrusion detection, File integrity monitoring
- Backups running, stored off the server, and one restore tested. Ransomware-proof backups
- Subscribed to advisories for the OS and every major package installed. Security advisories
- Written down who to call and what to do if the server is compromised. Incident response, Emergency help