Server hardening: baselines, patching, least services and logging
In short: Hardening reduces a server's attack surface by removing what it does not need and locking down what remains. Start from a recognised baseline such as the CIS Benchmarks, patch regularly, apply least privilege and send logs to a central system. Then check for drift, because settings change over time.
What hardening means
A fresh operating system install is designed to be easy to use, not secure. Hardening is the process of reducing the attack surface: the services, accounts, ports and settings an attacker could abuse. The aim is that each server does its job and nothing else, with every remaining feature configured safely.
Start from a baseline
You do not need to invent settings yourself. A security baseline is a documented list of recommended configurations. Widely used sources include the CIS Benchmarks from the Center for Internet Security, Microsoft security baselines for Windows Server, and the DISA STIGs used in government. Choose one, record any exceptions with a reason, and apply it automatically with Group Policy, Ansible or similar tools so every server is built the same way. See security frameworks for how baselines fit with wider standards.
Core hardening steps
- Install minimal. Use Server Core or a minimal Linux image. Remove unused roles, packages and sample files.
- Disable unused services and ports. Check what is listening (
ss -tulpnon Linux,Get-NetTCPConnection -State Listenon Windows) and turn off anything without a business reason. Disable legacy protocols such as SMBv1 and Telnet. - Lock down accounts. Rename or disable default accounts, use unique local admin passwords (Windows LAPS does this), require MFA for remote admin and give each person their own account.
- Restrict network access. Enable the host firewall and allow only required ports from required sources. Put management interfaces on a separate network.
- Secure remote access. Use SSH keys or RDP through a gateway or VPN; never expose RDP directly to the internet.
- Encrypt. Use TLS for services and disk encryption where the risk justifies it.
- Log centrally. Forward logs to a SIEM or log server with correct time from NTP.
Patching and monitoring
Patch management closes known vulnerabilities. Patch the OS, applications, hypervisor and firmware, including the BMC. Test updates on a small group first, then roll out on a regular schedule, and fast-track critical issues that are being actively exploited. The patch management note covers this in more depth.
Logging is what lets you notice an attack. At minimum capture sign-ins (successful and failed), privilege use, account changes, service installs and log clearing. On Windows, enable advanced audit policy; on Linux, use auditd and the systemd journal. Forward everything off the server, because an attacker who gains admin rights may try to delete local logs.
| Common mistake | Better practice |
|---|---|
| Hardening once at build time only | Scan regularly for configuration drift |
| Shared admin password on every server | Unique passwords managed by LAPS or a vault |
| Logs kept only on the server | Central, tamper-resistant log storage |
| Ignoring firmware and BMC updates | Include them in the patch cycle |
Tip: test hardening changes on a non-production server first. Some baseline settings can break older applications, so record exceptions rather than silently skipping controls.
Practice
What is the attack surface of a server?
Why should logs be forwarded to a central system?
Name a well-known source of server security baselines.
Key takeaways
- Hardening shrinks the attack surface: only what the server needs, configured safely.
- Start from a baseline such as the CIS Benchmarks and automate it.
- Remove unused services, restrict ports and apply least privilege to accounts.
- Patch OS, applications and firmware on a regular, tested schedule.
- Log centrally and check for configuration drift over time.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.