Server Hardening Checklist: 30 Steps to a Bulletproof Ubuntu Server

While security through obscurity is not a complete strategy, changing the SSH port from 22 to a non-standard port dramatically reduces automated brute force attempts. Most botnets only scan port 22.

Never allow direct root SSH access. Create a regular user with sudo privileges, then disable root login entirely. This forces attackers to guess both a username and password.

SSH keys are exponentially stronger than passwords. A 4096-bit RSA key or an Ed25519 key is practically impossible to brute force. Disable password authentication entirely after setting up key access.

Use the AllowUsers or AllowGroups directive to limit which accounts can SSH in. Even if an attacker compromises a service account, they cannot use it for SSH access.

Limit how long a connection can stay open during authentication and how many attempts are allowed per connection.

Ensure no account with an empty password can log in, and disable X11 forwarding if you do not need a graphical display tunnel.

Disable weak and deprecated algorithms. Only allow modern, battle-tested ciphers.

Add Google Authenticator (TOTP) as a second factor for SSH. Even if a key is stolen, the attacker still needs the time-based code.

Only allow traffic on ports that your services actually use. Block everything else by default with a deny-all incoming policy.

Even before Fail2ban kicks in, limit SSH connection attempts at the firewall level.

ICMP timestamps can leak server uptime information, and ICMP redirects can be used in man-in-the-middle attacks.

SYN cookies protect against SYN flood attacks without consuming server resources for half-open connections.

The kernel has many tunable parameters that affect security. Set these in /etc/sysctl.conf or /etc/sysctl.d/99-hardening.conf.

By default, /dev/shm allows programs to execute code from shared memory, which is a common exploitation technique.

Prevent execution of binaries from /tmp. Many exploits download payloads to /tmp and execute them there. This simple mount option neutralizes that attack vector.

Unpatched vulnerabilities are the number one cause of server compromises. Configure unattended-upgrades to install security patches automatically.

Every running service is a potential attack surface. List all active services and disable everything you do not use.

Protect the bootloader with a password to prevent an attacker with physical or console access from modifying boot parameters (e.g., booting into single-user mode).

Fail2ban monitors log files and automatically bans IPs that show malicious patterns like repeated failed login attempts.

AIDE (Advanced Intrusion Detection Environment) takes a snapshot of your filesystem and alerts you when files are modified. Essential for detecting rootkits and unauthorized changes.

Rkhunter scans for known rootkits, backdoors, and local exploits. Run it regularly and after any suspicious activity.

Ensure all logs go to a central location. If an attacker compromises the server, they may try to delete local logs. Remote logging preserves the evidence.

The Linux audit system tracks security-relevant events like file access, system calls, and user commands. This is essential for forensic analysis.

Regularly check who has logged into your server and when. Look for unusual patterns, off-hours logins, or logins from unexpected locations.

Use PAM (Pluggable Authentication Modules) to enforce minimum password length, complexity, and history requirements.

Only give sudo access to users who absolutely need it. Use visudo to configure granular permissions.

Review and tighten permissions on critical system files. Many fresh installations have overly permissive defaults.

AppArmor confines programs to a limited set of resources. Enable profiles for all critical services to contain potential breaches.

Use trusted DNS resolvers and enable DNSSEC validation. Prevent DNS poisoning attacks that could redirect your server's outgoing traffic to malicious servers.

The ultimate safety net is a tested backup. A backup that has never been restored is not a backup — it is a hope. Schedule regular test restores to verify your backups actually work.