Ubuntu Server Hardening Checklist

21 items · Technical · Hard difficulty · 1 hour

Practical steps to lock down an Ubuntu server quickly and safely.

• Update and upgrade installed packages

  Run apt update && apt upgrade to apply the latest security patches.

• Create a non-root sudo user

  Add an administrative user and grant sudo; avoid routine root logins.

• Upload and test SSH public key for the new user

  Install your key in ~/.ssh/authorized_keys and verify passwordless login.

• Configure SSH settings

  Edit /etc/ssh/sshd_config and apply the secure changes listed below.

• Change SSH port to a non-standard high port

  Pick a port >1024 and update Port in sshd_config; note the port for firewall rules.

• Disable root SSH login

  Set PermitRootLogin no in /etc/ssh/sshd_config to prevent direct root access.

• Require public-key auth and disable password login

  Set PasswordAuthentication no and PubkeyAuthentication yes to use keys only.

• Configure UFW firewall

  Define a minimal allowlist and enable the firewall to block unwanted traffic.

• Set UFW default incoming policy to deny

  Run ufw default deny incoming to enforce explicit allow rules only.

• Allow SSH through UFW on the chosen port

  Run ufw allow <port>/tcp (or ufw allow ssh if keeping port 22) before enabling firewall.

• Enable UFW and verify rules

  Run ufw enable then ufw status numbered to confirm rules and avoid lockout.

• Install and configure Fail2Ban to block brute-force attempts

  Enable the sshd filter and tune bantime, findtime, and maxretry for your environment.

• Enable automatic security updates (unattended-upgrades)

  Configure unattended-upgrades to install security updates automatically.

• Install and enable auditd logging

  Install auditd, enable the service, and configure rules for critical files and commands.

• Install Lynis security auditing tool

  Install Lynis (apt or official repo) to run a comprehensive local audit.

• Run Lynis security audit and review findings

  Run lynis audit system and address high/important warnings first.

• Run a CIS Benchmark scan and address high findings

  Use CIS guides/tools to evaluate compliance and remediate critical issues.

• Remove unused packages and disable unnecessary services

  Run apt autoremove and systemctl disable/stop services you don't need.

• Apply kernel hardening sysctl settings

  Harden network and kernel settings (persist in /etc/sysctl.conf) and reload.

• Set up regular backups of /etc and critical configs

  Automate periodic backups of configuration files to remote or offsite storage.

• Review and enforce AppArmor profiles

  Ensure AppArmor is enabled and set profiles to enforce for exposed services.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.