Introduction to Securing Pop!_OS Servers
Pop!_OS, developed by System76, is a powerful Linux distribution based on Ubuntu. While it is widely recognized as an excellent desktop operating system for developers and creators, its Ubuntu foundation makes it a highly capable and stable platform for servers as well. However, deploying a Pop!_OS server requires the same rigorous security considerations as any other Linux distribution exposed to the internet.
Securing a server is the practice of protecting the system, its data, and its network connections from unauthorized access, exploitation, and malicious attacks. It matters because an unsecured server is an open invitation to threat actors who can compromise your infrastructure, steal sensitive data, or use your server as part of a botnet. By following a practical security checklist, you can drastically reduce your attack surface and ensure your Pop!_OS server remains robust and reliable.
Initial Server Setup and Access Control
The first step in securing your Pop!_OS server is locking down access. You should never run services as the root user, and you must ensure that remote access is strictly controlled.
Updating the System
Before configuring anything, ensure your system is fully up to date. This patches known vulnerabilities in the kernel and installed packages.
sudo apt update
sudo apt upgrade -y
sudo apt autoremove -y
Creating a Non-Root User
Create a dedicated user account with sudo privileges for administrative tasks. This prevents direct root logins and provides an audit trail of administrative actions.
# Create a new user
sudo adduser devadmin
# Add the new user to the sudo group
sudo usermod -aG sudo devadmin
Securing SSH Access
Secure Shell (SSH) is the primary way to access your server remotely. By default, SSH might allow root logins and password authentication, both of which are significant security risks.
First, generate an SSH key pair on your local machine and copy the public key to the new devadmin user on the server:
# Run on your local machine
ssh-keygen -t ed25519 -C "admin@pop-os-server"
ssh-copy-id devadmin@your_server_ip
Once you have verified that you can log in with your SSH key, disable password authentication and root login by editing the SSH daemon configuration file.
sudo nano /etc/ssh/sshd_config
Modify the following lines inside the file:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Restart the SSH service to apply the changes:
sudo systemctl restart ssh
Network Security and Firewall Configuration
Controlling network traffic is a critical layer of defense. You should explicitly define which ports are open and block all other incoming traffic.
Configuring UFW (Uncomplicated Firewall)
Pop!_OS includes UFW by default. Configure it to deny all incoming connections by default and allow outgoing connections. Then, explicitly allow your SSH port (and any other ports you need, like HTTP/HTTPS).
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
# Enable the firewall
sudo ufw enable
# Check the status
sudo ufw status verbose
Implementing Fail2Ban
Even with SSH keys, automated bots will continuously attempt to brute-force your server. Fail2Ban monitors log files and bans IPs that show malicious signs, such as too many failed login attempts.
sudo apt install fail2ban -y
Create a local configuration file to override the default settings. This ensures your changes survive package updates.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
Under the [sshd] section, ensure it is enabled and configure the ban time and max retry limit:
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
Restart Fail2Ban to apply the new rules:
sudo systemctl restart fail2ban
sudo systemctl enable fail2ban
System Hardening and Best Practices
Beyond access control and firewalls, system hardening involves configuring the operating system to minimize vulnerabilities and automate maintenance.
Enabling Automatic Security Updates
To ensure your server is not left vulnerable to newly discovered exploits, enable automatic security updates. Pop!_OS uses the same unattended-upgrades package as Ubuntu.
sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
Securing Shared Memory
Shared memory (/dev/shm) can be used in some attacks to execute malicious code. You should secure it by mounting it with noexec and nosuid options.
Edit the /etc/fstab file:
sudo nano /etc/fstab
Add the following line at the bottom of the file:
tmpfs /dev/shm tmpfs defaults,noexec,nosuid 0 0
Remount the shared memory partition to apply the changes immediately:
sudo mount -o remount /dev/shm
Disabling Unused Services
Every running service is a potential attack vector. Audit your system to find and disable services that you do not need.
# List all listening services
sudo ss -tulpn
# Stop and disable a specific service (example: snapd, if unused)
sudo systemctl stop snapd
sudo systemctl disable snapd
Conclusion
Securing a Pop!_OS server is an ongoing process rather than a one-time setup. By applying this practical checklist—updating the system, enforcing strict SSH access, configuring a firewall, mitigating brute-force attacks with Fail2Ban, and hardening system configurations—you establish a strong security baseline. Always remember to regularly monitor your server logs, audit your installed packages, and stay informed about new vulnerabilities to ensure your infrastructure remains protected against evolving threats.