Ubuntu server hardening: the first hour after installation

A freshly installed Linux server connected to the internet starts receiving login attempts within minutes. These steps take about an hour and close the most common ways in. They work on current Ubuntu LTS releases and, with small changes, on Debian.

Step 1. Create a personal administrator

Every administrator gets their own account with sudo rights — no shared logins, no work as root.

sudo adduser admin1
sudo usermod -aG sudo admin1

Step 2. Log in with SSH keys

Create a key on your computer and copy it to the server. Protect the key with a passphrase.

# on your own computer:
ssh-keygen -t ed25519
ssh-copy-id admin1@SERVER_IP

Step 3. Disable root and password logins over SSH

After you have checked that key login works, turn off password and root logins.

sudo nano /etc/ssh/sshd_config.d/99-hardening.conf
# put these lines in the file:
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
# check and apply:
sudo sshd -t && sudo systemctl restart ssh

Step 4. Turn on the firewall

Block everything incoming except what the server really needs. In this example SSH is allowed only from the office or VPN network, and the web server is open to everyone.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.88.0/24 to any port 22 proto tcp
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose

Step 5. Install updates and enable automatic security updates

Security updates will then install every day. Plan reboots for kernel updates.

sudo apt update && sudo apt full-upgrade
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Step 6. Slow down password guessing with fail2ban

fail2ban temporarily blocks addresses that repeatedly fail to log in.

sudo apt install fail2ban
printf '[sshd]\nenabled = true\n' | sudo tee /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Step 7. Check what is listening and whether the release is supported

Every listening port is a possible way in — stop services you do not need. If the release is out of standard support (for example Ubuntu 20.04), attach Ubuntu Pro to keep receiving security fixes, or plan an upgrade.

sudo ss -tlnp
lsb_release -a
sudo pro status

Next steps

• Set up backups and test a restore.
• Send logs to a central system and monitor the server.
• Document what runs on the server and who is responsible for it.

The first hour of a server decides how the next years will go.

Need help with this? Contact CySec for a free consultation.

All articles