Guides

Linux server security

Practical, copy-paste steps for keeping attackers out of your servers — whether or not you use ThreatGuard. Written by Naitik Nayyar, founder of ThreatGuard.

• What is an SSH brute-force attack (and is your server under one)?

  What SSH brute-force attacks are, why every server on the internet gets them within minutes, how to check if yours is under one, and how to stop them.

  5 min read

• How to block an IP address on Linux (ufw, firewalld, iptables)

  Block an IP address or range on a Linux server with ufw, firewalld or iptables — make it permanent, unblock it, avoid locking yourself out, and handle Docker.

  7 min read

• How to find open ports on a Linux server — and close the risky ones

  See which ports your Linux server listens on with ss, check what the internet can actually reach with nmap, and close exposed databases, Redis and Docker ports.

  7 min read

• How to check CPU, memory and disk usage on a Linux server

  The commands that show what is slowing a Linux server down — load average, top, free, df, du, iostat — and how to read the numbers people often get wrong.

  6 min read

• How to stop SSH brute-force attacks on Ubuntu

  Check whether your server is under attack, switch to SSH keys, turn off password logins safely, rate-limit SSH and block repeat attackers — step by step for Ubuntu 22.04 and 24.04.

  8 min read

• How to see who is trying to log in to your Linux server

  The commands that show failed and successful SSH logins on Linux — lastb, last, auth.log and journalctl — plus one-liners for the top attacking IPs and usernames.

  6 min read