Securing Ubuntu Servers: A Practical Checklist

Introduction to Securing Ubuntu Servers

Securing an Ubuntu server, often referred to as server hardening, is the process of enhancing the security of a newly deployed server by reducing its surface of vulnerability. When you spin up a new Ubuntu server, it comes with a baseline configuration designed for ease of use rather than maximum security. Hardening involves configuring the operating system, network, and installed applications to mitigate potential attack vectors.

Why does this matter? In today's digital landscape, automated bots continuously scan the internet for vulnerable servers. A newly deployed server with default settings can be compromised within minutes. Securing your server protects sensitive data, ensures application availability, prevents your server from being used as a botnet node, and helps maintain compliance with data protection regulations. This practical checklist will guide you through the essential steps to lock down your Ubuntu server.

Initial Server Setup and User Management

The first step in securing your server is to move away from using the root account for daily operations. The root user has absolute power over the system, meaning a typo or a malicious script executed as root can destroy the entire server.

Creating a Non-Root User

You should create a standard user account and grant it sudo privileges. This allows you to perform administrative tasks when needed, but requires you to explicitly prefix commands with sudo, reducing the risk of accidental system changes.

# Log in as root
adduser devuser
# Follow the prompts to set a strong password and user details

# Add the new user to the sudo group
usermod -aG sudo devuser

# Switch to the new user to test sudo access
su - devuser
sudo ls /root

Securing SSH Access

Secure Shell (SSH) is your primary gateway into the server. By default, SSH allows password authentication and root login, both of which are prime targets for brute-force attacks. You should disable these and rely on SSH keys instead.

First, generate an SSH key pair on your local machine and copy the public key to the server:

# Run this on your LOCAL machine
ssh-keygen -t ed25519 -C "your_email@example.com"

# Copy the public key to the server
ssh-copy-id devuser@your_server_ip

Once you have verified that you can log in with your SSH key, modify the SSH daemon configuration on the server to disable password authentication and root login.

# Open the SSH configuration file
sudo nano /etc/ssh/sshd_config

# Find and modify the following lines:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

# Save and exit, then restart the SSH service
sudo systemctl restart ssh

Firewall Configuration with UFW

A firewall acts as a barrier between your server and the internet, controlling incoming and outgoing network traffic based on predetermined security rules. Ubuntu comes with Uncomplicated Firewall (UFW), a user-friendly tool for managing iptables rules.

Basic UFW Rules

Before enabling the firewall, you must explicitly allow your SSH connections; otherwise, you will lock yourself out of the server. If you are running a web server, you will also need to allow HTTP (port 80) and HTTPS (port 443).

# Allow SSH connections
sudo ufw allow OpenSSH
# Alternatively, if the app profile isn't found: sudo ufw allow 22/tcp

# Allow HTTP and HTTPS (if running a web server)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Check the status of the firewall
sudo ufw status verbose

Protecting Against Brute Force Attacks

Even with SSH keys enabled, it is a good practice to implement an intrusion prevention system to block malicious IP addresses. Fail2Ban is an excellent tool that monitors log files (like SSH logs) and temporarily bans IPs that show malicious signs, such as too many password failures.

Installing and Configuring Fail2Ban

Fail2Ban is available in the default Ubuntu repositories and works out of the box with sensible defaults for SSH protection.

# Install Fail2Ban
sudo apt update
sudo apt install fail2ban -y

# Fail2Ban uses /etc/fail2ban/jail.local for local configurations.
# Create a basic configuration to protect SSH
sudo nano /etc/fail2ban/jail.local

Add the following configuration to the jail.local file to customize the SSH jail:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

Restart the service to apply the changes:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

Automatic Security Updates

Software vulnerabilities are discovered regularly. Keeping your server's packages updated is one of the most effective ways to prevent exploitation. Ubuntu provides the unattended-upgrades package to automatically install security updates as they become available.

Enabling Unattended Upgrades

You can install and configure automatic updates easily using the built-in utilities.

# Install the necessary packages
sudo apt install unattended-upgrades apt-listchanges -y

# Enable automatic updates interactively
sudo dpkg-reconfigure -plow unattended-upgrades

You can verify the configuration by checking the 20auto-upgrades file:

cat /etc/apt/apt.conf.d/20auto-upgrades

It should contain the following lines to ensure daily updates:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Best Practices for Ongoing Security

Securing a server is not a one-time task but an ongoing process. To maintain a strong security posture, consider the following best practices:

Principle of Least Privilege: Only grant users and applications the permissions they absolutely need to function. Avoid using the sudo group liberally.
Regular Audits: Periodically review user accounts, SSH keys, and firewall rules. Remove access for users who no longer require it.
Monitor Logs: Regularly check system logs (/var/log/auth.log, /var/log/syslog) for suspicious activity. Tools like Logwatch can automate daily log summaries.
Disable Unused Services: Run sudo ss -tulnp to list all listening ports. Disable and uninstall any services that are not strictly necessary for your server's function.
Implement Backups: Even the most secure servers can fail or be compromised. Maintain regular, encrypted, off-site backups of your critical data and test your restoration process periodically.

Conclusion

Securing an Ubuntu server requires a proactive approach to mitigate the constant threat of automated attacks and targeted exploits. By creating non-root users, enforcing SSH key authentication, configuring a strict firewall, deploying Fail2Ban, and enabling automatic security updates, you establish a robust baseline of defense. Security is an ongoing journey, and by adhering to the best practices outlined in this checklist, you can significantly reduce your server's vulnerability and ensure a safer environment for your applications and data.