miker/Compose-Files
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate

Browse Source
This commit is contained in:
Mike McFetridge
2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Backups/Miker/Bookstack/server-hardening-security-baseline.md
+123
View File
@@ -0,0 +1,123 @@
---
tags:
- Documentation
- Bookstack
- Notes
---
# Server Hardening & Security Baseline
# Ubuntu Server Hardening & Security Baseline
A comprehensive guide to securing a fresh Ubuntu Server installation for production or home-lab deployment.
## Phase 1: Initial System Updates & Hostname
Always ensure the repository lists and core software dependencies are fully up to date before making configuration changes.
<div class="code-block ng-tns-c1605810258-137 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash"><div class="formatted-code-block-internal-container ng-tns-c1605810258-137"><div class="animated-opacity ng-tns-c1605810258-137"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-137 ng-star-inserted"><span class="ng-tns-c1605810258-137">Bash</span><div class="buttons ng-tns-c1605810258-137 ng-star-inserted"></div></div></div></div></div>```
# Update package lists and upgrade all system software
sudo apt update && sudo apt upgrade -y
# Set a clean, fully qualified domain name (FQDN) hostname
sudo hostnamectl set-hostname your-server-name
```
<div class="code-block ng-tns-c1605810258-137 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--1"><div class="formatted-code-block-internal-container ng-tns-c1605810258-137"><div class="animated-opacity ng-tns-c1605810258-137"></div></div></div>## Phase 2: Secure User Management
Never run applications directly as the root user. Create a dedicated administrative user with sudo privileges and lock down root access.
### 1. Create a Sudo User
<div class="code-block ng-tns-c1605810258-138 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-1"><div class="formatted-code-block-internal-container ng-tns-c1605810258-138"><div class="animated-opacity ng-tns-c1605810258-138"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-138 ng-star-inserted"><span class="ng-tns-c1605810258-138">Bash</span><div class="buttons ng-tns-c1605810258-138 ng-star-inserted"></div></div></div></div></div>```
# Create the new administrative user
sudo adduser sysadmin
# Add the user to the sudo group
sudo usermod -aG sudo sysadmin
```
<div class="code-block ng-tns-c1605810258-138 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--4"><div class="formatted-code-block-internal-container ng-tns-c1605810258-138"><div class="animated-opacity ng-tns-c1605810258-138"></div></div></div>### 2. Disable the Root Password &amp; Active Shell
<div class="code-block ng-tns-c1605810258-139 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-2"><div class="formatted-code-block-internal-container ng-tns-c1605810258-139"><div class="animated-opacity ng-tns-c1605810258-139"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-139 ng-star-inserted"><span class="ng-tns-c1605810258-139">Bash</span><div class="buttons ng-tns-c1605810258-139 ng-star-inserted"></div></div></div></div></div>```
# Lock the root user account
sudo passwd -l root
```
<div class="code-block ng-tns-c1605810258-139 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--7"><div class="formatted-code-block-internal-container ng-tns-c1605810258-139"><div class="animated-opacity ng-tns-c1605810258-139"></div></div></div>## Phase 3: SSH Hardening (Targeted `/etc/ssh/sshd_config`)
Enforce cryptographic authentication over passwords and close common remote exploit vectors.
1. Generate an SSH Keypair on your local machine (if you haven't already):
<div class="code-block ng-tns-c1605810258-140 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-140"><div class="animated-opacity ng-tns-c1605810258-140"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-140 ng-star-inserted"><span class="ng-tns-c1605810258-140">Bash</span><div class="buttons ng-tns-c1605810258-140 ng-star-inserted"></div></div></div></div></div>```
ssh-keygen -t ed25519 -b 521 -C "admin-key"
```
<div class="code-block ng-tns-c1605810258-140 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-140"><div class="animated-opacity ng-tns-c1605810258-140"></div></div></div>
2. Copy the key to your server:
<div class="code-block ng-tns-c1605810258-141 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-141"><div class="animated-opacity ng-tns-c1605810258-141"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-141 ng-star-inserted"><span class="ng-tns-c1605810258-141">Bash</span><div class="buttons ng-tns-c1605810258-141 ng-star-inserted"></div></div></div></div></div>```
ssh-copy-id -i ~/.ssh/id_ed25519.pub sysadmin@YOUR_SERVER_IP
```
<div class="code-block ng-tns-c1605810258-141 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-141"><div class="animated-opacity ng-tns-c1605810258-141"></div></div></div>
3. Edit the SSH Daemon Configuration (`sudo nano /etc/ssh/sshd_config.d/hardening.conf`):
<div class="code-block ng-tns-c1605810258-142 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-142"><div class="animated-opacity ng-tns-c1605810258-142"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-142 ng-star-inserted"><span class="ng-tns-c1605810258-142">Ini, TOML</span><div class="buttons ng-tns-c1605810258-142 ng-star-inserted"></div></div></div></div></div>```
# Enforce modern, secure SSH configurations
Port 22 # Change to a custom port (e.g., 2222) to stop automated bot sweeps
PermitRootLogin no # Drop direct root login capabilities completely
PasswordAuthentication no # Disable password authentication; enforce SSH Keys only
PubkeyAuthentication yes # Explicitly permit public key authentication
X11Forwarding no # Disable GUI forwarding to reduce attack surface
MaxAuthTries 3 # Limit authentication attempts per connection drop
ClientAliveInterval 300 # Disconnect idle sessions after 5 minutes
ClientAliveCountMax 0 # Enforce explicit logout when idle threshold met
```
<div class="code-block ng-tns-c1605810258-142 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-142"><div class="animated-opacity ng-tns-c1605810258-142"></div></div></div>
4. Validate the syntax and restart the daemon:
<div class="code-block ng-tns-c1605810258-143 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-143"><div class="animated-opacity ng-tns-c1605810258-143"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-143 ng-star-inserted"><span class="ng-tns-c1605810258-143">Bash</span><div class="buttons ng-tns-c1605810258-143 ng-star-inserted"></div></div></div></div></div>```
sudo sshd -t
sudo systemctl restart ssh
```
<div class="code-block ng-tns-c1605810258-143 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-143"><div class="animated-opacity ng-tns-c1605810258-143"></div></div></div>
## Phase 4: Firewall Configuration (UFW)
Implement a strict "default-deny" inbound network posture using the Uncomplicated Firewall.
<div class="code-block ng-tns-c1605810258-144 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-3"><div class="formatted-code-block-internal-container ng-tns-c1605810258-144"><div class="animated-opacity ng-tns-c1605810258-144"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-144 ng-star-inserted"><span class="ng-tns-c1605810258-144">Bash</span><div class="buttons ng-tns-c1605810258-144 ng-star-inserted"></div></div></div></div></div>```
# Set default firewall rules
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow your specific SSH port (Match the port set in Phase 3)
sudo ufw allow 22/tcp
# (Optional) Allow Web traffic if hosting applications
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Enable the firewall
sudo ufw enable
sudo ufw status verbose
```
<div class="code-block ng-tns-c1605810258-144 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--10"><div class="formatted-code-block-internal-container ng-tns-c1605810258-144"><div class="animated-opacity ng-tns-c1605810258-144"></div></div></div>## Phase 5: Automated Security Patching
Install `unattended-upgrades` to guarantee that critical security vulnerabilities are patched automatically without requiring manual sysadmin intervention.
<div class="code-block ng-tns-c1605810258-145 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-4"><div class="formatted-code-block-internal-container ng-tns-c1605810258-145"><div class="animated-opacity ng-tns-c1605810258-145"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-145 ng-star-inserted"><span class="ng-tns-c1605810258-145">Bash</span><div class="buttons ng-tns-c1605810258-145 ng-star-inserted"></div></div></div></div></div>```
# Install the upgrade package tool
```