linux
Hardening Linux Server Security: SSH Key Hardening, UFW Firewall, Fail2ban, and Auditd Setup
A comprehensive checklist to protect production Linux nodes from brute-force attacks, port scanning, unauthorized privilege escalation, and lateral movement.
By Shubhankar Tripathi
•
•
15 min read
## Introduction
Leaving a default Linux server exposed to the public Internet invites automated bots and brute-force scans within seconds. Implementing **defense-in-depth** hardening ensures that your hosts are resilient against both external intrusion and internal lateral traversal.
In this practical guide, we will lock down SSH daemon configurations, configure strict UFW packet filtering, deploy Fail2ban rate limiting, and activate system audit logging.
---
## Step 1 — Hardening SSH Daemon Configuration
Edit `/etc/ssh/sshd_config.d/99-hardened.conf`:
```bash
# /etc/ssh/sshd_config.d/99-hardened.conf
Port 2222
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
MaxAuthTries 3
X11Forwarding no
AllowAgentForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
PubkeyAuthentication yes
AuthenticationMethods publickey
```
Restart the SSH service:
```bash
sudo systemctl restart sshd
```
:::warning
**Do Not Close Your Current Session**:
Always open a new terminal window to test connection on the new port before closing your existing SSH session!
:::
---
## Step 2 — Configuring UFW Firewall
```bash
# Reset default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow hardened SSH port
sudo ufw allow 2222/tcp comment "Hardened SSH"
sudo ufw allow 80/tcp comment "HTTP"
sudo ufw allow 443/tcp comment "HTTPS"
# Enable firewall
sudo ufw enable
sudo ufw status verbose
```
---
## Summary
Following these standard sysadmin procedures dramatically reduces server attack surfaces and satisfies key SOC 2 and ISO 27001 baseline security requirements.