Linux Server Preventive Maintenance Guide: Avoiding Downtime

Linux servers are the backbone of the global internet due to their inherent stability and security. However, no operating system runs perfectly without continuous maintenance. Without preventive routines, accumulated logs fill up disks and unpatched vulnerabilities become attack vectors.

Below, we present the main recommended routines to keep your Linux servers healthy.

1. Security Package Updates (Patch Management)

New security vulnerabilities are discovered daily. Updating the kernel and system libraries is the most basic and efficient defense.

Best practices:

• Configure automatic updates only for critical security patches using tools like unattended-upgrades on Ubuntu/Debian.
• Test general package and programming language updates (such as Node.js or Python) in a separate staging environment before applying them to the production server.

2. Active Monitoring and Disk Cleaning

Running out of disk space is one of the biggest causes of database crashes. If the disk hits 100% capacity, the database (such as PostgreSQL or MySQL) will crash to prevent file corruption.

What to do:

• Configure automatic log rotation (logrotate) to compress and delete system and web server logs after a set period.
• Constantly monitor the growth of the /var/log directory and remove orphaned packages from the package manager (e.g., apt clean or yum clean all).

3. Hardening and Firewall Configuration

Securing the server entry ports drastically reduces the chance of brute-force attacks.

Crucial steps:

• Change the default SSH port: Changing the default port 22 to a custom high port reduces automated bot scanning attempts by more than 90%.
• Disable password login: Configure SSH to accept connections exclusively via cryptographic public keys (SSH keys).
• Configure Fail2Ban: A tool that monitors logs and temporarily blocks IPs that repeatedly attempt incorrect logins in the firewall table (iptables/ufw).

4. Commands for the weekly routine

Security updates on Ubuntu, with no automatic reboot. The dry run shows what would be installed:

sudo apt install -y unattended-upgrades
sudo systemctl enable --now unattended-upgrades
sudo unattended-upgrade --dry-run

Disk and logs. journalctl --vacuum-time deletes journal older than 14 days. apt clean drops the cache of packages already installed:

df -h / /var
sudo du -xh /var/log | sort -h | tail
sudo journalctl --vacuum-time=14d
sudo apt clean
sudo logrotate -d /etc/logrotate.d/nginx

logrotate -d simulates. It does not rotate the file. If Nginx is not installed, the path is missing and the command says so.

SSH with keys only, in a drop-in, without editing the main file. Keep the current session open and test a second login before you close it:

sudo tee /etc/ssh/sshd_config.d/99-hardening.conf >/dev/null <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
EOF
sudo sshd -t && sudo systemctl reload ssh

Fail2ban reads the SSH log and blocks the IP that fails the key several times:

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

sshd -t with no output means the configuration is valid. A syntax error here, if you had restarted instead of reloaded, would lock you out.

Conclusion

Preventive maintenance is not a waste of time, but an investment to avoid operational losses. Adopting these practices ensures that your application remains online and that your business information is secure from external attacks.