Compose-Files/Backups/Miker/Bookstack/server-hardening-security-baseline.md

tags

tags
Documentation Bookstack Notes

Server Hardening & Security Baseline

Ubuntu Server Hardening & Security Baseline

A comprehensive guide to securing a fresh Ubuntu Server installation for production or home-lab deployment.

Phase 1: Initial System Updates & Hostname

Always ensure the repository lists and core software dependencies are fully up to date before making configuration changes.

Bash

``` # Update package lists and upgrade all system software sudo apt update && sudo apt upgrade -y

Set a clean, fully qualified domain name (FQDN) hostname

sudo hostnamectl set-hostname your-server-name

<div class="code-block ng-tns-c1605810258-137 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--1"><div class="formatted-code-block-internal-container ng-tns-c1605810258-137"><div class="animated-opacity ng-tns-c1605810258-137"></div></div></div>## Phase 2: Secure User Management

Never run applications directly as the root user. Create a dedicated administrative user with sudo privileges and lock down root access.

### 1. Create a Sudo User

<div class="code-block ng-tns-c1605810258-138 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-1"><div class="formatted-code-block-internal-container ng-tns-c1605810258-138"><div class="animated-opacity ng-tns-c1605810258-138"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-138 ng-star-inserted"><span class="ng-tns-c1605810258-138">Bash</span><div class="buttons ng-tns-c1605810258-138 ng-star-inserted"></div></div></div></div></div>```
# Create the new administrative user
sudo adduser sysadmin

# Add the user to the sudo group
sudo usermod -aG sudo sysadmin

### 2. Disable the Root Password & Active Shell

Bash

``` # Lock the root user account sudo passwd -l root

<div class="code-block ng-tns-c1605810258-139 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk--7"><div class="formatted-code-block-internal-container ng-tns-c1605810258-139"><div class="animated-opacity ng-tns-c1605810258-139"></div></div></div>## Phase 3: SSH Hardening (Targeted `/etc/ssh/sshd_config`)

Enforce cryptographic authentication over passwords and close common remote exploit vectors.

1. Generate an SSH Keypair on your local machine (if you haven't already):
    
    <div class="code-block ng-tns-c1605810258-140 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-140"><div class="animated-opacity ng-tns-c1605810258-140"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-140 ng-star-inserted"><span class="ng-tns-c1605810258-140">Bash</span><div class="buttons ng-tns-c1605810258-140 ng-star-inserted"></div></div></div></div></div>```
    ssh-keygen -t ed25519 -b 521 -C "admin-key"
    
    ```
    
    <div class="code-block ng-tns-c1605810258-140 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-140"><div class="animated-opacity ng-tns-c1605810258-140"></div></div></div>
2. Copy the key to your server:
    
    <div class="code-block ng-tns-c1605810258-141 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-141"><div class="animated-opacity ng-tns-c1605810258-141"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-141 ng-star-inserted"><span class="ng-tns-c1605810258-141">Bash</span><div class="buttons ng-tns-c1605810258-141 ng-star-inserted"></div></div></div></div></div>```
    ssh-copy-id -i ~/.ssh/id_ed25519.pub sysadmin@YOUR_SERVER_IP
    
    ```
    
    <div class="code-block ng-tns-c1605810258-141 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-141"><div class="animated-opacity ng-tns-c1605810258-141"></div></div></div>
3. Edit the SSH Daemon Configuration (`sudo nano /etc/ssh/sshd_config.d/hardening.conf`):
    
    <div class="code-block ng-tns-c1605810258-142 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-142"><div class="animated-opacity ng-tns-c1605810258-142"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-142 ng-star-inserted"><span class="ng-tns-c1605810258-142">Ini, TOML</span><div class="buttons ng-tns-c1605810258-142 ng-star-inserted"></div></div></div></div></div>```
    # Enforce modern, secure SSH configurations
    Port 22                           # Change to a custom port (e.g., 2222) to stop automated bot sweeps
    PermitRootLogin no                # Drop direct root login capabilities completely
    PasswordAuthentication no         # Disable password authentication; enforce SSH Keys only
    PubkeyAuthentication yes          # Explicitly permit public key authentication
    X11Forwarding no                  # Disable GUI forwarding to reduce attack surface
    MaxAuthTries 3                    # Limit authentication attempts per connection drop
    ClientAliveInterval 300           # Disconnect idle sessions after 5 minutes
    ClientAliveCountMax 0             # Enforce explicit logout when idle threshold met
    
    ```
    
    <div class="code-block ng-tns-c1605810258-142 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-142"><div class="animated-opacity ng-tns-c1605810258-142"></div></div></div>
4. Validate the syntax and restart the daemon:
    
    <div class="code-block ng-tns-c1605810258-143 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-143"><div class="animated-opacity ng-tns-c1605810258-143"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-143 ng-star-inserted"><span class="ng-tns-c1605810258-143">Bash</span><div class="buttons ng-tns-c1605810258-143 ng-star-inserted"></div></div></div></div></div>```
    sudo sshd -t
    sudo systemctl restart ssh
    
    ```
    
    <div class="code-block ng-tns-c1605810258-143 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation"><div class="formatted-code-block-internal-container ng-tns-c1605810258-143"><div class="animated-opacity ng-tns-c1605810258-143"></div></div></div>

## Phase 4: Firewall Configuration (UFW)

Implement a strict "default-deny" inbound network posture using the Uncomplicated Firewall.

<div class="code-block ng-tns-c1605810258-144 ng-animate-disabled ng-trigger ng-trigger-codeBlockRevealAnimation" id="bkmrk-bash-3"><div class="formatted-code-block-internal-container ng-tns-c1605810258-144"><div class="animated-opacity ng-tns-c1605810258-144"><div class="code-block-decoration header-formatted gds-emphasized-body-m ng-tns-c1605810258-144 ng-star-inserted"><span class="ng-tns-c1605810258-144">Bash</span><div class="buttons ng-tns-c1605810258-144 ng-star-inserted"></div></div></div></div></div>```
# Set default firewall rules
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow your specific SSH port (Match the port set in Phase 3)
sudo ufw allow 22/tcp

# (Optional) Allow Web traffic if hosting applications
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable
sudo ufw status verbose

## Phase 5: Automated Security Patching

Install unattended-upgrades to guarantee that critical security vulnerabilities are patched automatically without requiring manual sysadmin intervention.

Bash

``` # Install the upgrade package tool ```