Initial assessment
Port scanning with Nmap, checks with Lynis or CIS-CAT, and an inventory of services, users and outdated packages.
Security & Recovery
Linux and Windows server hardening
Most breaches start through an open door: SSH with a weak password, RDP exposed to the internet, or a control panel nobody has updated in years. We check your servers against the CIS benchmarks and close those doors with minimal disruption to running services. Every change is written down.
Tools & technology
server-hardening
- Lynis
- CIS Benchmarks
- Nmap
- Fail2ban
- CSF
- nftables
- OpenSSH
- Group Policy
- auditd
6work areas
4deliverables
4steps
What is Server Hardening?
Server hardening closes the common ways into a Linux or Windows server, such as SSH with weak passwords, RDP exposed to the internet and unused services, using the CIS benchmarks as the yardstick. You need it if your logs are filling up with failed login attempts, the data center handed you a server with no security configuration, or a client or auditor wants a server security report. PikoSystem starts by recording the current state with Nmap and Lynis, without changing anything. Then root and password logins over SSH are disabled and Fail2ban goes in, RDP is restricted to VPN with NLA, and CSF, nftables or Windows Defender Firewall is set up with a default-deny policy. Configuration is backed up first, and services are tested after each stage. At the end you have a before-and-after report with Lynis or CIS scores and a change list for each server.
When you need Server Hardening
- Our server logs are full of failed SSH login attempts.
- Our Windows server has RDP open directly to the internet.
- The data center handed us a server with no security configuration at all.
- A client or auditor has asked for a server security report.
What Server Hardening includes
Access lockdown
Root login and password authentication disabled in SSH, key-based login and Fail2ban; on Windows, RDP restricted to VPN with NLA enabled.
Host firewall
CSF, nftables or Windows Defender Firewall with a default-deny policy and only the required ports open.
Updates and services
Unused services and packages removed, automatic security updates enabled, and Nginx, PHP and MySQL settings tightened.
Windows policies
CIS recommendations applied through Group Policy, including password policy, account lockout, SMBv1 removal and logon auditing.
Logging and audit
auditd or Windows Event Forwarding enabled, with login logs shipped to a separate server.
What you get from Server Hardening
- A before-and-after report with Lynis or CIS scores
- A list of changes applied to each server
- A server security checklist for future builds
- Open items that need a decision from you
Server Hardening: a practical guide
Windows Server hardening with CIS: Level 1 or Level 2?
The CIS Benchmark for Windows Server has two profiles. Level 1 covers settings most servers can take without breaking services, such as password policy, logon auditing and disabling legacy protocols. Level 2 is stricter and aimed at sensitive systems; some of its settings, NTLM restrictions for example, can break older applications or printer connections.
We apply Level 1 as the baseline and pick Level 2 items per server role. In a domain, settings go into a GPO linked to a test OU before wider rollout. Standalone servers are handled with LGPO and Policy Analyzer from the Microsoft Security Compliance Toolkit, and results are checked with CIS-CAT Lite.
Linux server hardening mistakes we keep finding
Moving SSH to another port is often the only step taken. It quiets the logs and does little against a targeted attacker. A costlier mistake is disabling password login before key login has been tested. Run sshd -t before reloading sshd, and keep a second session open.
On AlmaLinux and Rocky, turning SELinux off instead of fixing contexts or registering a new port with semanage removes a real layer of protection. On Debian 12, which no longer installs rsyslog by default, Fail2ban without backend = systemd reads no logs and silently does nothing. And host firewalls written only for IPv4 often leave every port open over IPv6.
How to prepare for server hardening
The most important item is a fallback way in. If an SSH or firewall change goes wrong, a KVM, iLO or iDRAC console, or the VNC console in your data center panel, is the only route back, so confirm it works before we start.
List the software on each server, the ports it uses and the addresses that connect to it, such as branch accounting software reaching SQL Server. You will also need a fresh snapshot or backup, access to control panels like cPanel or DirectAdmin, and a low-traffic window.
How big is a server security project?
The first factor is how many servers there are and how varied they are. Ten identical Ubuntu servers can be hardened with one checklist and one playbook, while a mix of Linux, domain-joined Windows and panel-managed hosts needs a plan per group.
Legacy software that relies on TLS 1.0, SMBv1 or a local admin account adds testing time, and so does a report format required by an auditor or client. Remote access is usually enough; an on-site visit is only needed for servers without an out-of-band management console.
How Server Hardening works
-
01
Review and scan
Using agreed access, we record the current state without changing anything.
-
02
Change plan
We walk you through each change and its impact on your services, and schedule a window to apply them.
-
03
Apply and test
We back up configuration files, apply changes in stages and test services after each one.
-
04
Report and handover
The scans are run again, and you get a comparison report alongside the change log.
Server Hardening: frequently asked questions
Could hardening break our website or software?
It can, because some settings don't suit older software. So we back up the configuration first, apply changes in stages and test after each one. Anything that causes a problem gets rolled back, and we propose an alternative.
Do you install the CSF firewall on cPanel or DirectAdmin servers?
Yes, CSF together with LFD. We open the right ports for the panel and mail services, route alerts to your email, and set things up so the firewall doesn't conflict with the panel's own services.
Is hardening a one-time job?
The baseline holds for a long time. Software keeps changing, though, and new vulnerabilities turn up, so we recommend periodic reviews and regular patching. Both can be part of a support contract.
Related searches
- server hardening
- VPS security
- Linux server hardening
- Windows Server CIS hardening
- CSF firewall setup
- server security checklist
Related services
Quote
Tell us what you need, we'll come back with a plan and a price
A few lines on where things stand and what you want is enough. An engineer calls you back directly; requests don't go through sales.
- 01We read your request and call if anything is unclear.
- 02If needed, we do a quick remote review or a site visit.
- 03You get a written proposal with scope, timeline and cost.