Lab: hardening a Linux server (SSH, firewall, updates)

Aim and what you need

The aim is to apply the handful of controls that protect most Linux servers: current patches, no direct root login, key-based SSH, a default-deny firewall and as few running services as possible.

• An Ubuntu Server LTS VM (for example 24.04) at 10.10.10.20 in your isolated lab, with temporary internet access for updates.
• A client VM (Kali or any Linux) at 10.10.10.10 to connect from.
• A snapshot taken before you begin.

Design

Tip: when you change SSH or firewall settings on a remote server, keep your current session open and test with a second session. If the new settings lock you out, you can still fix them from the first.

Steps

1. Update the system and turn on automatic security updates.
2. Create an admin user with sudo rights.
3. On the client, create an Ed25519 key pair and copy the public key to the server.
4. Create an SSH drop-in file that disables root and password logins, then test the syntax and reload.
5. Set the firewall to deny incoming traffic by default and allow SSH only from the lab network.
6. List listening services and remove any you do not need.

sudo apt update && sudo apt full-upgrade -y
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
sudo adduser labadmin
sudo usermod -aG sudo labadmin

On the client:

ssh-keygen -t ed25519 -C "labadmin@lab"
ssh-copy-id [email protected]
ssh [email protected]

On the server, create /etc/ssh/sshd_config.d/50-hardening.conf with sudo nano and add:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
AllowUsers labadmin
X11Forwarding no

sudo sshd -t
sudo systemctl reload ssh
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 10.10.10.0/24 to any port 22 proto tcp
sudo ufw enable
sudo ss -tulpn
sudo systemctl disable --now <unused-service>

Verify

From the client, test each control. Success means: key login as labadmin works; root login is refused; a password-only attempt is refused with "Permission denied (publickey)"; UFW is active with only your SSH rule; ss lists only the services you expect.

ssh [email protected]
ssh [email protected]
ssh -o PubkeyAuthentication=no [email protected]
sudo ufw status verbose
sudo sshd -T | grep -E "permitrootlogin|passwordauthentication"
systemctl status unattended-upgrades
nmap -p- 10.10.10.20

The final Nmap scan, run from the client, should show only port 22 open. Compare it with a scan taken before hardening, as in the Nmap inventory lab.

Troubleshooting and clean-up

• Locked out: use the VM console in the hypervisor, fix the drop-in file, run sudo sshd -t and reload.
• Settings ignored: in OpenSSH, the first value read wins. A cloud-init file such as 50-cloud-init.conf may set PasswordAuthentication yes; check with sudo sshd -T, which prints the effective settings.
• Key not accepted: permissions on ~/.ssh must be 700 and authorized_keys 600.
• UFW blocks a needed service: add a specific allow rule rather than turning the firewall off.

Optionally add fail2ban to ban addresses after repeated failures, and see the log analysis lab for reading failed logins. Restore your snapshot to repeat the lab. Keep the private key safe; never copy it to the server.