Hardening Ubuntu & Red Hat Servers: Essential Security Checklist

Deploying a production cloud server on AWS, DigitalOcean, or bare metal without thorough security hardening invites brute-force intrusions, automated scanners, and potential compromise within hours. Whether running Ubuntu Server 24.04 LTS or Red Hat Enterprise Linux (RHEL), following this essential checklist ensures robust server protection.

1. Dedicated Sudo User & SSH Key Authentication

Never run everyday services as the root user. Begin by creating an unprivileged administration account and requiring Ed25519 or 4096-bit RSA keys:

# Create user and grant sudo permissions
adduser deployer
usermod -aG sudo deployer  # Ubuntu/Debian
# or on RHEL: usermod -aG wheel deployer

# Generate local SSH key (on your client machine)
ssh-keygen -t ed25519 -C "deployer@production"

# Install your public key to the remote server
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@<SERVER_IP>

2. Lock Down the SSH Daemon (`/etc/ssh/sshd_config`)

Disable password authentication completely and disallow direct root login:

sudo nano /etc/ssh/sshd_config.d/99-hardened.conf

Add the following directives:

Port 2222                        # Change default port (mitigates 95% of bot scans)
PermitRootLogin no              # Disable root login
PasswordAuthentication no       # Require SSH key only
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

Test configuration syntax and restart the service:

sudo sshd -t && sudo systemctl restart ssh

3. Implement Strict Firewall Rules (UFW / Firewalld)

Only expose the absolute minimum required network ports.

**On Ubuntu (UFW):**

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment "Hardened SSH"
sudo ufw allow 80/tcp comment "HTTP"
sudo ufw allow 443/tcp comment "HTTPS"
sudo ufw enable

**On Red Hat Enterprise Linux (Firewalld):**

sudo firewall-cmd --permanent --zone=public --add-port=2222/tcp
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload

4. Deploy Fail2Ban Against Brute-Force Attacks

Fail2ban dynamically bans IP addresses exhibiting malicious connection behavior:

sudo apt update && sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Configure aggressive jail defaults:

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 4

[sshd]
enabled  = true
port     = 2222
mode     = aggressive

Enable and start Fail2Ban:

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

5. Automated Security Patching

Never leave vulnerable packages unpatched on production instances. Configure unattended security updates:

# Ubuntu
sudo apt install unattended-upgrades update-notifier-common -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Red Hat
sudo dnf install dnf-automatic -y
sudo sed -i 's/apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

Conclusion

By combining strong asymmetric SSH keys, a custom port, strict firewall ingress filtering, automated intrusion response (Fail2Ban), and unattended updates, your Linux server is prepared for resilient, enterprise-grade production workloads.