Initial Setup

Begin with these essential steps after installing Ubuntu Server.

Create a Non-root User

Always avoid using the root account for daily tasks.

# Create a new user
adduser username

# Add user to sudo group
usermod -aG sudo username

Set Up a Basic Firewall

UFW (Uncomplicated Firewall) makes managing firewall rules easy.

# Enable UFW
ufw enable

# Allow SSH connections
ufw allow ssh

# Check firewall status
ufw status
Tip: Always ensure SSH is allowed before enabling the firewall to avoid locking yourself out.

System Updates

Keep your system updated with the latest security patches.

# Update package lists
apt update

# Upgrade installed packages
apt upgrade

# Install unattended-upgrades for automatic security updates
apt install unattended-upgrades

# Enable automatic updates
dpkg-reconfigure -plow unattended-upgrades
Note: While automatic updates are convenient, test them in a non-production environment first.

Firewall Configuration

Proper firewall configuration is critical for server security.

Configure UFW

# Allow specific ports
ufw allow 80/tcp # HTTP
ufw allow 443/tcp # HTTPS
ufw allow 123/udp # NTP

# Deny unnecessary ports
ufw deny 23 # Telnet
ufw deny 21 # FTP

# Enable logging
ufw logging on

Install and Configure Fail2Ban

Fail2Ban helps prevent brute force attacks.

# Install Fail2Ban
apt install fail2ban

# Copy the configuration file
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Restart Fail2Ban
systemctl restart fail2ban

SSH Hardening

Secure SSH to prevent unauthorized access.

# Edit the SSH configuration file
nano /etc/ssh/sshd_config

Make the following changes to your SSH configuration:

# Change SSH port (optional)
Port 2222

# Disable root login
PermitRootLogin no

# Limit user access
AllowUsers username

# Use key-based authentication only
PasswordAuthentication no

# Enable two-factor authentication (if configured)
AuthenticationMethods publickey,keyboard-interactive

# Restart SSH service after changes
systemctl restart sshd
Warning: Before disabling password authentication, ensure you have set up SSH key authentication and tested it.

User Management

Proper user management reduces security risks.

Set Password Policies

# Install password quality library
apt install libpam-pwquality

# Edit password policy
nano /etc/security/pwquality.conf

# Set minimum password length
minlen = 12

# Set password complexity
minclass = 3

Configure Password Aging

# Edit login definitions
nano /etc/login.defs

# Set password max days to 90
PASS_MAX_DAYS 90

# Set password warn age to 7
PASS_WARN_AGE 7

Filesystem Security

Secure your filesystem to protect sensitive data.

Filesystem Permissions

# Set strict permissions on sensitive directories
chmod 700 /home/username
chmod 600 /home/username/.ssh/authorized_keys

# Set sticky bit on world-writable directories
chmod +t /tmp

Disable Unwanted Filesystems

# Edit filesystem configuration
nano /etc/modprobe.d/filesystem.conf

# Add the following lines to disable uncommon filesystems
install cramfs /bin/false
install freevxfs /bin/false
install jffs2 /bin/false
install hfs /bin/false
install hfsplus /bin/false
install squashfs /bin/false
install udf /bin/false

Service Hardening

Minimize your attack surface by removing unnecessary services.

Audit Installed Packages

# List all installed packages
dpkg -l

# Remove unnecessary services
apt purge telnetd rsh-server rsh-redone-server

Check Listening Ports

# See all listening ports
netstat -tunlp

# Alternatively use ss
ss -tunlp
Principle of Least Privilege: Only install and enable services that are absolutely necessary for your server's function.

Monitoring & Logging

Implement monitoring to detect suspicious activities.

Enable Process Accounting

# Install process accounting
apt install acct

# Enable process accounting
systemctl enable acct

Install and Configure Auditd

# Install auditd
apt install auditd

# Start and enable auditd
systemctl enable auditd
systemctl start auditd

Monitor Log Files

Regularly check important log files:

/var/log/auth.log # Authentication logs
/var/log/syslog # System logs
/var/log/ufw.log # Firewall logs
/var/log/fail2ban.log # Fail2Ban logs

Backup Strategy

Implement a reliable backup strategy to prevent data loss.

Automate Backups

# Install backup tools
apt install rsync cron-apt

# Create a backup script
nano /usr/local/bin/backup.sh

Example Backup Script

#!/bin/bash
# Backup important directories
rsync -a --delete /home/username /backup/
rsync -a --delete /etc /backup/
rsync -a --delete /var/www /backup/

# Add to crontab for daily execution
crontab -e

# Add this line to run daily at 2 AM
0 2 * * * /usr/local/bin/backup.sh
Important: Store backups in a secure off-site location and test restoration procedures regularly.