Securing a Linux Ubuntu 24.04 Server: SysAdmin Hardening Checklist

First root access and admin user creation

Log in as root once, create a non-privileged user for daily admin work, add them to the sudo group.

# On your local machine
ssh root@YOUR_IP

# On the server (as root)
adduser admin           # create the admin user
usermod -aG sudo admin  # add to sudo group
mkdir -p /home/admin/.ssh
chmod 700 /home/admin/.ssh
cp /root/.ssh/authorized_keys /home/admin/.ssh/
chown -R admin:admin /home/admin/.ssh

Initial system updates

A freshly provisioned server typically contains 20 to 60 outdated packages. Patching them before any other operation avoids installing dependencies on vulnerable bases.

apt update
apt upgrade -y
apt dist-upgrade -y
apt autoremove -y
apt autoclean

If a “Pending kernel upgrade” message appeared, reboot the server (reboot) before moving to the next step.

SSH hardening (keys, custom port, no root login)

Three coordinated changes to /etc/ssh/sshd_config: deny direct root login, disable password authentication, and move the default port (22) to a less-scanned high port.

# Backup the config before editing
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Edit the config
nano /etc/ssh/sshd_config

# Lines to set or add:
Port 2222                           # custom port (pick any 1024-65535)
PermitRootLogin no                  # no more direct root login
PasswordAuthentication no           # SSH keys only
PubkeyAuthentication yes
MaxAuthTries 3                      # 3 attempts max per connection
ClientAliveInterval 300             # auto-disconnect after 5 min
ClientAliveCountMax 2
LoginGraceTime 30
AllowUsers admin                    # restrict to the admin user only

Validate the syntax before restarting the service, otherwise you lose access:

sshd -t
# No output means OK; if there is one, fix it before continuing

# Restart SSH
systemctl restart ssh

# From your local machine, in a new terminal
ssh admin@YOUR_IP -p 2222

UFW firewall with minimal rules

UFW (Uncomplicated Firewall) is Ubuntu’s wrapper around nftables/iptables. Principle: everything is denied by default, you explicitly open the ports you need.

apt install -y ufw
ufw default deny incoming
ufw default allow outgoing

# Open the custom SSH port (mandatory before enabling)
ufw allow 2222/tcp comment 'SSH custom port'

# Open application ports as needed
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'

# Enable the firewall
ufw enable     # answer y

For servers with a remote database (Postgres, MySQL, Redis), do not open ports 5432, 3306, 6379 to the internet: use an SSH tunnel or a WireGuard VPN from the application consuming the database.

fail2ban against SSH brute-force

Even with SSH key-only, bots will try connection attempts at scale (every failure consumes CPU and pollutes the logs). fail2ban automatically blocks IPs that fail N times in M minutes.

apt install -y fail2ban

# Create the local config (jail.local takes precedence over jail.conf)
cat > /etc/fail2ban/jail.local <<'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
port = 2222
backend = systemd
EOF

systemctl enable --now fail2ban

To unban an IP that was blocked by mistake: fail2ban-client set sshd unbanip 1.2.3.4.

Automatic updates (unattended-upgrades)

Ubuntu security patches ship on average 2 to 3 times per week. Applying them automatically (while avoiding major version upgrades that can break things) is the best effort/impact security measure.

apt install -y unattended-upgrades apt-listchanges

# Enable Ubuntu's default config
dpkg-reconfigure -plow unattended-upgrades
# Answer Yes to the question

# Verify the config file
nano /etc/apt/apt.conf.d/50unattended-upgrades

In 50unattended-upgrades, verify that security sources are enabled:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}";
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";
};
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

AppArmor in enforce mode

AppArmor is Ubuntu’s Mandatory Access Control: it restricts each service to a profile of allowed files and syscalls. On Ubuntu 24.04 it is installed by default, but some profiles run in “complain” mode (alert only). We switch them to “enforce”.

apt install -y apparmor apparmor-utils apparmor-profiles apparmor-profiles-extra

# Current status
aa-status

# Switch all profiles to enforce
aa-enforce /etc/apparmor.d/*

If a service breaks after enabling enforce mode, check the logs (journalctl -u apparmor) and either adjust the offending profile or temporarily switch it back to complain: aa-complain /etc/apparmor.d/usr.sbin.service-name.

Audit logs with auditd

auditd records sensitive system events (reads of critical files, sudo commands, config modifications). Essential for answering questions like “who modified /etc/passwd yesterday at 2 pm?”.

apt install -y auditd audispd-plugins

# Minimal rules: watch critical files
cat > /etc/audit/rules.d/hardening.rules <<'EOF'
# User account modifications
-w /etc/passwd -p wa -k user_modification
-w /etc/shadow -p wa -k user_modification
-w /etc/group -p wa -k user_modification
-w /etc/sudoers -p wa -k sudoers_modification
-w /etc/sudoers.d/ -p wa -k sudoers_modification

# SSH modifications
-w /etc/ssh/sshd_config -p wa -k ssh_config

# Abnormal network egress
-a always,exit -F arch=b64 -S socket -F a0=10 -k network_socket

# Lock the rules (no modification without reboot)
-e 2
EOF

systemctl enable --now auditd
systemctl restart auditd

To inspect events: ausearch -k user_modification or aureport -au.

Time synchronisation and NTP

A server whose clock drifts by more than a few seconds creates two problems: its TLS certificates may appear invalid (rejection of outbound HTTPS connections), and log correlation with other machines becomes impossible. Ubuntu 24.04 uses systemd-timesyncd by default.

timedatectl set-timezone Europe/Paris   # or your time zone
timedatectl set-ntp true

# Verify
timedatectl status

Final verification and snapshot

Before considering the server production-ready, batch of final checks in one block:

# Consolidated checks (";" separator so everything runs even if one command fails)
echo "=== SSH ==="                  ; grep -E "^(Port|PermitRoot|PasswordAuth)" /etc/ssh/sshd_config
echo "=== UFW ==="                  ; ufw status numbered | head -10
echo "=== fail2ban ==="             ; fail2ban-client status sshd
echo "=== unattended-upgrades ===" ; systemctl is-active unattended-upgrades
echo "=== AppArmor ==="             ; aa-status | head -3
echo "=== auditd ==="               ; systemctl is-active auditd
echo "=== Updates ==="              ; apt list --upgradable 2>/dev/null | wc -l
echo "=== Uptime ==="               ; uptime

If every output is consistent with expectations, take a server snapshot at your provider (OVH “Backup snapshot”, Hetzner “Snapshot”, AWS “AMI”, Scaleway “Snapshot”). This gives you a clean rollback point in case of later mishaps.

For production-critical servers, then add uptime monitoring (SecurityWatch or UptimeRobot) and application supervision (Netdata, Grafana Cloud Free, or Prometheus + node_exporter).