---
tags:
- Documentation
- Bookstack
- Notes
---
# Server Hardening & Security Baseline
# Ubuntu Server Hardening & Security Baseline
A comprehensive guide to securing a fresh Ubuntu Server installation for production or home-lab deployment.
## Phase 1: Initial System Updates & Hostname
Always ensure the repository lists and core software dependencies are fully up to date before making configuration changes.
```
# Update package lists and upgrade all system software
sudo apt update && sudo apt upgrade -y
# Set a clean, fully qualified domain name (FQDN) hostname
sudo hostnamectl set-hostname your-server-name
```
## Phase 2: Secure User Management
Never run applications directly as the root user. Create a dedicated administrative user with sudo privileges and lock down root access.
### 1. Create a Sudo User
```
# Create the new administrative user
sudo adduser sysadmin
# Add the user to the sudo group
sudo usermod -aG sudo sysadmin
```
### 2. Disable the Root Password & Active Shell
```
# Lock the root user account
sudo passwd -l root
```
## Phase 3: SSH Hardening (Targeted `/etc/ssh/sshd_config`)
Enforce cryptographic authentication over passwords and close common remote exploit vectors.
1. Generate an SSH Keypair on your local machine (if you haven't already):
```
ssh-keygen -t ed25519 -b 521 -C "admin-key"
```
2. Copy the key to your server:
```
ssh-copy-id -i ~/.ssh/id_ed25519.pub sysadmin@YOUR_SERVER_IP
```
3. Edit the SSH Daemon Configuration (`sudo nano /etc/ssh/sshd_config.d/hardening.conf`):
```
# Enforce modern, secure SSH configurations
Port 22 # Change to a custom port (e.g., 2222) to stop automated bot sweeps
PermitRootLogin no # Drop direct root login capabilities completely
PasswordAuthentication no # Disable password authentication; enforce SSH Keys only
PubkeyAuthentication yes # Explicitly permit public key authentication
X11Forwarding no # Disable GUI forwarding to reduce attack surface
MaxAuthTries 3 # Limit authentication attempts per connection drop
ClientAliveInterval 300 # Disconnect idle sessions after 5 minutes
ClientAliveCountMax 0 # Enforce explicit logout when idle threshold met
```
4. Validate the syntax and restart the daemon:
```
sudo sshd -t
sudo systemctl restart ssh
```
## Phase 4: Firewall Configuration (UFW)
Implement a strict "default-deny" inbound network posture using the Uncomplicated Firewall.
```
# Set default firewall rules
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow your specific SSH port (Match the port set in Phase 3)
sudo ufw allow 22/tcp
# (Optional) Allow Web traffic if hosting applications
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Enable the firewall
sudo ufw enable
sudo ufw status verbose
```
## Phase 5: Automated Security Patching
Install `unattended-upgrades` to guarantee that critical security vulnerabilities are patched automatically without requiring manual sysadmin intervention.
```
# Install the upgrade package tool
```