What hardening means
A freshly installed server often contains more than it needs: services, accounts, sample data, open ports. Hardening removes or secures everything that is not needed. Recognised templates are the CIS Benchmarks, Microsoft's security recommendations and the BSI IT-Grundschutz modules for servers.
The key measures
- Install minimally: only the required roles and packages.
- Keep current: patch the operating system and applications regularly.
- Review services and ports: disable what is unnecessary, open only what is required in the firewall.
- Accounts and rights: secure default accounts, limit administrator rights, individual accounts instead of shared ones.
- Strong sign-in: on Linux SSH with keys and no direct root login; on Windows MFA for administrators and unique local administrator passwords, for example with Windows LAPS.
- Disable legacy protocols: for example SMBv1 and weak encryption methods.
- Logging: record security-relevant events and collect them centrally.
- Encryption and backup: encrypt disks and test backups.
Windows and Linux compared
On Windows, group policies and security baselines control many settings centrally, especially in Active Directory environments. On Linux the same is done with configuration management and templates. The principle is identical: define it cleanly once, roll it out reproducibly and check regularly.
Hardening as a process
Hardening is not a one-off step. Define a reference configuration, document deviations and review at intervals. Virtualisation platforms such as Proxmox make this easier because hardened templates can be cloned and changes tested before deployment.