Server Hardening on Ubuntu: Reducing the Attack Surface

Server Hardening on Ubuntu: Reducing the Attack Surface

This article explains how to harden an Ubuntu server by disabling unnecessary services, minimizing privileges, and configuring the firewall. It is written for system administrators who want to set up a production server securely.

Requirements

- Ubuntu Server 22.04 LTS or 24.04 LTS (fresh installation) - Root access or a user with sudo privileges - Basic knowledge of the Linux command line - Optional: Ubuntu Pro subscription for additional security features

Steps

1. Update the system to the latest security versions

A fresh Ubuntu installation may contain outdated packages. Update everything before making any other changes.

sudo apt update && sudo apt upgrade -y

2. Inventory unused services and ports

Before disabling anything, you need to know what is running. Check which services are active and which ports are open.

systemctl list-units --type=service --state=running
ss -tulpn

Make a list of services you do not need for the server's function. Think of services such as `cups`, `avahi-daemon`, or `bluetooth` on a dedicated server.

3. Disable and remove unnecessary services

Disable each unnecessary service and prevent it from loading at startup. Replace `dienstnaam` with the actual service name from step 2.

sudo systemctl stop dienstnaam
sudo systemctl disable dienstnaam

If you want to completely remove the service, use `apt purge`. This also removes the configuration files.

sudo apt purge dienstnaam -y

4. Apply minimal privileges with sudo and user accounts

Create a separate user for daily tasks instead of root. This user only gets the privileges that are necessary.

sudo adduser beheerder
sudo usermod -aG sudo beheerder

Test the new user by logging in and running a command with sudo. Only use root for emergencies.

5. Check and tighten file permissions

Check the permissions of critical system files. The following commands provide insight into who can read, modify, or execute what.

ls -la /etc/passwd /etc/shadow /etc/ssh/sshd_config
sudo chmod 644 /etc/passwd
sudo chmod 640 /etc/shadow

Set a secure default umask for new files. Add this to `/etc/profile`:

echo "umask 027" | sudo tee -a /etc/profile

6. Configure the firewall with ufw

Enable the Uncomplicated Firewall and only allow the ports the server truly needs. Replace `22` with the port of your SSH service if you have changed it.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

Check the firewall status to confirm that the rules are active.

sudo ufw status verbose

7. Apply SSH hardening

Adjust the SSH configuration to disable weak authentication methods. Edit `/etc/ssh/sshd_config` and change or add the following lines:

sudo nano /etc/ssh/sshd_config

Set the following in this file:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3

Restart the SSH service to apply the changes.

sudo systemctl restart sshd

Note: only set `PasswordAuthentication` to `no` after you have configured and tested SSH keys. Otherwise, you will lock yourself out.

8. Activate Ubuntu Pro for automated patching

Ubuntu Pro offers additional security features such as livepatch and extended security updates. Activate the service with your subscription details.

sudo pro attach jouw-contract-token

Then check which security services are active.

sudo pro status

Verification

Run these checks to confirm that the hardening has been applied correctly:

sudo ufw status verbose
systemctl list-units --type=service --state=running
ss -tulpn | grep LISTEN
sudo pro status

The firewall must be active with only the allowed ports. The list of running services should only contain the necessary services. Ubuntu Pro must show the security services as active.

Frequently asked problems

I have locked myself out after changing SSH settings

Restart the server via the console of your hosting provider. Log in via the console and set `PasswordAuthentication` back to `yes`. Then check that your SSH key is correctly configured before changing the setting again.

ufw is blocking my SSH connection

First add the SSH rule before enabling the firewall. If your connection is already broken, use the console of your hosting provider to disable the firewall with `sudo ufw disable`. Then add the correct rule and re-enable the firewall.

A service I need no longer starts after disabling

Check that you disabled the correct service with `systemctl status dienstnaam`. Restart the service with `sudo systemctl start dienstnaam` and check the logs with `journalctl -u dienstnaam` to find the cause.

Hardening is not a one-time action; new vulnerabilities appear as soon as your system is running, and any change to the configuration can introduce new weak points. Therefore, schedule periodic checks and repeat these steps after every major system change.