Linux Server
Hardening Guide
Essential security practices to protect Debian and Ubuntu servers against unauthorized access and brute-force attacks.
1. SSH Key Authentication & Configuration
Generate an Ed25519 key on your local machine and transfer it to your server:
ssh-keygen -t ed25519 -C "admin@ezgclan.eu"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-server-ipEdit SSH configuration on the server:
sudo nano /etc/ssh/sshd_configEnforce SSH key logins and disable root password access:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding nosudo systemctl restart ssh2. Configure UFW Firewall
Restrict incoming traffic to required services only:
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable3. Install & Configure Fail2Ban
Automatically block IPs exhibiting repeated authentication failures:
sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.localConfigure the SSH jail:
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 1dsudo systemctl restart fail2ban