How to secure Ubuntu server - security hardening guide 2026
|

How to Secure Ubuntu 26.04 Server: Complete Security Hardening Guide 2026

ByMark Hirtenmacher Posted on Updated on

In 2026, securing your Ubuntu server is more critical than ever. With cyber threats evolving rapidly, implementing comprehensive security hardening measures is essential for protecting your infrastructure. This complete guide will show you exactly how to secure Ubuntu server deployments using industry-standard best practices.

Whether you’re running Ubuntu 24.04 LTS or the upcoming Ubuntu 26.04, these security hardening techniques will help you build a fortress around your server infrastructure. We’ll cover everything from basic firewall configuration to advanced intrusion detection systems.

Why Security Hardening Matters for Ubuntu Servers

Ubuntu servers power millions of websites and applications worldwide. However, a default Ubuntu installation leaves several security gaps that attackers can exploit. When you secure Ubuntu server systems properly, you reduce the attack surface significantly and protect your data from unauthorized access.

According to recent security reports, over 60% of successful server breaches exploit misconfigured security settings. The good news? Most of these attacks are preventable with proper security hardening.

Step 1: Update System and Enable Automatic Security Updates

The foundation of any security strategy starts with keeping your system updated. Outdated packages contain known vulnerabilities that attackers actively scan for. Timely patching is especially vital when mitigating critical Linux kernel privilege escalation exploits such as memory inspection flaws.

Update your Ubuntu server immediately:



1
2
3
sudo apt update

sudo apt upgrade -y

sudo apt dist-upgrade -y

Enable automatic security updates to ensure critical patches install without manual intervention:



1
2
sudo apt install unattended-upgrades -y

sudo dpkg-reconfigure --priority=low unattended-upgrades

Edit the configuration file to fine-tune which updates install automatically:



1
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Ensure the security updates line is uncommented:



1
"${distro_id}:${distro_codename}-security";

Step 2: Configure UFW Firewall to Secure Ubuntu Server

The Uncomplicated Firewall (UFW) provides a user-friendly interface for managing iptables firewall rules. Properly configured firewall rules are essential when you want to secure Ubuntu server infrastructure.

Install and configure UFW:



1
2
3
sudo apt install ufw -y

sudo ufw default deny incoming

sudo ufw default allow outgoing

Allow SSH before enabling the firewall (critical – don’t lock yourself out!):



1
2
sudo ufw allow 22/tcp

sudo ufw enable

Check firewall status:



1
sudo ufw status verbose

Add rules for specific services as needed (HTTP, HTTPS, etc.):



1
2
sudo ufw allow 80/tcp

sudo ufw allow 443/tcp

Pro tip: Use application profiles for common services. View available profiles with

1
<a class="wpil_keyword_link" href="https://www.howto-do.it/what-is-sudo-superuser-do/" title="sudo" data-wpil-keyword-link="linked" data-wpil-monitor-id="1736">sudo</a> ufw app list

.

Step 3: Implement SSH Hardening

SSH is the primary remote access method for Ubuntu servers, making it a critical security component. Weak SSH configurations are among the most exploited vulnerabilities.

Disable root login via SSH:



1
sudo nano /etc/ssh/sshd_config

Modify these critical settings:



1
2
3
4
5
6
PermitRootLogin no

PasswordAuthentication no

PubkeyAuthentication yes

Port 2222

MaxAuthTries 3

LoginGraceTime 20

Restart SSH service to apply changes:



1
sudo systemctl restart sshd

Important: Before disabling password authentication, ensure SSH key authentication works correctly. Test your SSH key login from another terminal session before logging out.

Generate a strong SSH key pair (if you haven’t already):



1
ssh-keygen -t ed25519 -C "[email protected]"

Copy your public key to the server:



1
ssh-copy-id -p 2222 username@server_ip

Step 4: Install and Configure Fail2Ban

Fail2Ban monitors log files and automatically blocks IP addresses showing malicious behavior. This tool is essential to secure Ubuntu server against brute-force attacks. For an in-depth setup including custom regex filters, see our dedicated Fail2Ban brute force protection walkthrough.

Install Fail2Ban:



1
sudo apt install fail2ban -y

Create a local configuration file:



1
2
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

sudo nano /etc/fail2ban/jail.local

Configure SSH protection:



1
2
3
4
5
6
7
8
[sshd]

enabled = true

port = 2222

filter = sshd

logpath = /var/log/auth.log

maxretry = 3

bantime = 3600

findtime = 600

Restart Fail2Ban:



1
2
sudo systemctl restart fail2ban

sudo systemctl enable fail2ban

Check banned IPs:



1
sudo fail2ban-client status sshd

Step 5: Implement AppArmor Security Profiles

AppArmor provides mandatory access control by restricting programs to a limited set of resources. Ubuntu includes AppArmor by default, but you should verify it’s active and properly configured.

Check AppArmor status:



1
sudo aa-status

Ensure AppArmor is enforcing mode:



1
sudo systemctl status apparmor

Install additional AppArmor utilities:



1
sudo apt install apparmor-utils -y

Put profiles in enforce mode:



1
sudo aa-enforce /etc/apparmor.d/*

Step 6: Configure System Auditing with Auditd

The Linux Audit system provides detailed logging of security-relevant information. When you secure Ubuntu server systems, comprehensive logging enables effective incident response.

Install auditd:



1
sudo apt install auditd audispd-plugins -y

Enable audit service:



1
2
sudo systemctl enable auditd

sudo systemctl start auditd

Add audit rules for critical files:



1
2
3
sudo auditctl -w /etc/passwd -p wa -k passwd_changes

sudo auditctl -w /etc/shadow -p wa -k shadow_changes

sudo auditctl -w /etc/sudoers -p wa -k sudoers_changes

Make rules persistent:



1
sudo nano /etc/audit/rules.d/audit.rules

Search audit logs:



1
sudo ausearch -k passwd_changes

Step 7: Disable Unnecessary Services and Ports

Every running service represents a potential attack vector. Minimize your attack surface by disabling services you don’t need.

List all running services:



1
sudo systemctl list-units --type=service --state=running

Disable unnecessary services (example: cups printing service):



1
2
sudo systemctl stop cups

sudo systemctl disable cups

Check listening ports:



1
sudo ss -tulpn

Investigate unfamiliar open ports and close them if unnecessary.

Step 8: Implement Intrusion Detection with AIDE

Advanced Intrusion Detection Environment (AIDE) monitors file integrity and alerts you to unauthorized changes.

Install AIDE:



1
sudo apt install aide -y

Initialize the AIDE database (this takes several minutes):



1
sudo aideinit

Move the database to production:



1
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Run integrity check:



1
sudo aide --check

Schedule daily AIDE checks via cron:



1
sudo crontab -e

Add this line:



1
0 5 * * * /usr/bin/aide --check | mail -s "AIDE Report" [email protected]

Step 9: Secure Shared Memory

Shared memory can be exploited for privilege escalation attacks. Mounting it with restricted permissions adds an extra security layer.

Edit fstab:



1
sudo nano /etc/fstab

Add this line:



1
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

Remount shared memory:



1
sudo mount -o remount /run/shm

Step 10: Enable and Configure SELinux (Optional Advanced Security)

While Ubuntu uses AppArmor by default, some administrators prefer SELinux for its granular security policies. This step is optional but provides additional hardening for high-security environments.

Install SELinux:



1
sudo apt install selinux-basics selinux-policy-default auditd -y

Activate SELinux:



1
2
sudo selinux-activate

sudo reboot

After reboot, check SELinux status:



1
sestatus

Note: SELinux and AppArmor conflict. Choose one based on your security requirements and expertise level.

Additional Security Best Practices

Beyond the core hardening steps, consider these additional measures when you secure Ubuntu server infrastructure:

  • Use strong passwords: Implement password policies requiring 12+ character passwords with complexity requirements
  • Enable two-factor authentication: Add 2FA for SSH using Google Authenticator or similar tools
  • Regular backups: Implement automated backup solutions and test restore procedures regularly
  • Monitor logs actively: Use log aggregation tools like ELK stack or Graylog for centralized monitoring
  • Keep minimal software: Only install packages you actually need – less software means fewer vulnerabilities
  • Use dedicated user accounts: Never use root for daily operations – use sudo instead
  • Implement network segmentation: Use VLANs and security groups to isolate critical systems

Security Hardening Checklist

Use this comprehensive checklist to verify you’ve implemented all critical security measures:

  • System updates configured and automatic security updates enabled
  • UFW firewall configured with deny-by-default policy
  • SSH hardened (root login disabled, key authentication only, custom port)
  • Fail2Ban installed and monitoring SSH attempts
  • AppArmor active and profiles enforced
  • Auditd logging security events
  • Unnecessary services disabled
  • AIDE monitoring file integrity
  • Shared memory secured
  • Strong password policy enforced

Monitoring Your Secured Ubuntu Server

Security hardening isn’t a one-time task – continuous monitoring ensures your defenses remain effective.

Essential monitoring commands:



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# Check failed login attempts

sudo grep "Failed password" /var/log/auth.log



# Monitor active connections

sudo netstat -tulpn



# Check system logs

sudo journalctl -xe



# Review Fail2Ban status

sudo fail2ban-client status



# Audit active users

who

last

Consider implementing monitoring solutions like Prometheus and Grafana for comprehensive infrastructure monitoring.

Conclusion

Learning how to secure Ubuntu server infrastructure requires implementing multiple layers of defense. By following this comprehensive hardening guide, you’ve significantly reduced your server’s attack surface and established robust security practices.

Remember that security is an ongoing process, not a destination. Regularly review your security configurations, apply updates promptly, and stay informed about emerging threats. Schedule quarterly security audits to ensure your hardening measures remain effective.

The investment in properly securing your Ubuntu server pays dividends through reduced risk of data breaches, compliance with security standards, and peace of mind knowing your infrastructure is protected against common attack vectors.

For more advanced security topics, check out our guides on implementing intrusion prevention systems and Ubuntu security best practices.

Similar Posts