Ubuntu 24.04 Server Hardening Guide (2026)

If you are deploying a new server this year, proper ubuntu 24.04 server hardening is the absolute most critical first step you must take before exposing your machine to the public internet. Cyber threats have evolved rapidly as we move through 2026, with automated botnets and zero-day exploits targeting default Linux installations within minutes of them coming online. This comprehensive guide will walk you through transforming a fresh, vulnerable Ubuntu 24.04 LTS (Noble Numbat) installation into a fortress. From securing SSH access and configuring rigid firewalls to enabling the latest HWE kernel, we will cover every actionable step needed to lock down your server environment.

Why Ubuntu 24.04 Server Hardening Matters in 2026

The cybersecurity landscape in 2026 is unforgiving. Relying solely on a strong root password is no longer sufficient. Attackers utilize AI-driven vulnerability scanners that can map network topologies, test default credentials, and exploit unpatched software simultaneously. Ubuntu 24.04 LTS is robust out of the box, but default configurations prioritize compatibility and ease of use over strict security.

When performing ubuntu 24.04 server hardening, it is highly recommended to consult the Ubuntu official security guide for foundational practices.

By implementing proactive security measures, you achieve “defense in depth.” This means if one layer of security fails (for instance, a web application vulnerability), an attacker is still blocked by secondary defenses like strict user permissions, mandatory access controls via AppArmor, or network-level firewall drops. Taking the time to perform these hardening steps ensures compliance with modern security standards and drastically reduces your attack surface.

Initial Setup: Update System and Enable HWE Kernel 6.17

The foundation of any secure system is up-to-date software. Before modifying any configuration files, ensure your system packages are fully updated. Additionally, for servers requiring the latest hardware support and security mitigations, upgrading to the Hardware Enablement (HWE) stack is highly recommended. In 2026, Ubuntu 24.04’s HWE kernel has reached version 6.17, offering significant performance and security benefits.

Another crucial step in ubuntu 24.04 server hardening involves adhering to industry standards like the CIS Benchmarks for Ubuntu.

Step 1: Update the Base System

Run the following commands to update your package lists and upgrade all installed software:

1
2
3
sudo apt update

sudo apt upgrade -y

sudo apt autoremove -y

Step 2: Install HWE Kernel 6.17

To take advantage of hwe kernel 6.17 security features, install the hardware enablement stack. This provides updated kernel protections against modern CPU side-channel attacks and improved memory management.

1
sudo apt install --install-recommends linux-generic-hwe-24.04 -y

Once the installation is complete, reboot your server to load the new kernel:

1
sudo reboot

Verify that you are running the new kernel with:

.

User Account Security: Disable Root Login and Configure Sudo

Using the root account for daily operations is a massive security risk. Instead, you should create a standard user account with sudo privileges and lock down the root account completely.

Effective ubuntu 24.04 server hardening often requires tools to prevent brute-force attacks. You can learn more from the Fail2Ban official docs.

Step 1: Create a New Sudo User

If you haven’t already, create a dedicated user for management tasks. Replace

with your preferred username:

1
2
sudo adduser sysadmin

sudo usermod -aG sudo sysadmin

Step 2: Lock the Root Account

Ensure that no one can log in as root using a password. Ubuntu usually does this by default, but it is best to verify and enforce it:

1
sudo passwd -l root

Step 3: Secure the Sudo Environment

To prevent unauthorized privilege escalation, we can require a password for sudo commands and log sudo attempts. Edit the sudoers file safely using

:

1
sudo visudo

Ensure the following defaults are set at the top of the file to increase logging and require terminal authentication:

1
2
3
4
5
Defaults    env_reset

Defaults    mail_badpass

Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

Defaults    use_pty

Defaults    logfile="/var/log/sudo.log"

SSH Hardening: Securing Remote Access

The Secure Shell (SSH) daemon is the primary entry point for administrators, making it the most targeted service on any server. To secure ssh ubuntu 24.04 installations, we must disable legacy authentication methods and implement strict access controls. If you are configuring SSH across different devices, you might also find our guide on how to SSH into Raspberry Pi from anywhere useful for understanding broader remote access concepts.

Implementing proper ubuntu 24.04 server hardening ensures your system remains resilient against emerging threats.

Step 1: Generate Ed25519 SSH Keys

On your local machine (not the server), generate a highly secure Ed25519 key pair. RSA is still acceptable if it’s 4096-bit, but Ed25519 is faster and more secure.

1
ssh-keygen -t ed25519 -C "admin@myubuntu2404"

Copy the public key to your new server user:

1
ssh-copy-id sysadmin@your_server_ip

Step 2: Edit the SSH Daemon Configuration

Open the SSH configuration file on your server:

1
sudo nano /etc/ssh/sshd_config

Modify or add the following directives to harden the service:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# Change the default port from 22 to something obscure

Port 2244



# Disable root login entirely

PermitRootLogin no



# Disable password authentication (Force SSH keys)

PasswordAuthentication no

PermitEmptyPasswords no



# Limit maximum authentication attempts

MaxAuthTries 3



# Disable X11 forwarding if you don't use graphical apps

X11Forwarding no



# Allow only specific users to login via SSH

AllowUsers sysadmin

Save the file and restart the SSH service. Caution: Keep your current SSH session open in another terminal just in case you lock yourself out!

1
sudo systemctl restart ssh

Step 3: Install and Configure Fail2Ban

Fail2Ban automatically bans IP addresses that show malicious signs, such as too many password failures. Install it to protect your custom SSH port.

1
2
sudo apt install fail2ban -y

sudo systemctl enable fail2ban

Create a local jail configuration:

1
2
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

sudo nano /etc/fail2ban/jail.local

Find the

section and update it to match your custom port:

1
2
3
4
5
6
7
[sshd]

enabled = true

port = 2244

logpath = %(sshd_log)s

backend = %(sshd_backend)s

maxretry = 3

bantime = 3600

Restart Fail2Ban:

1
sudo systemctl restart fail2ban

Firewall Configuration with UFW

Uncomplicated Firewall (UFW) provides a user-friendly frontend for iptables/nftables. A strict firewall policy is non-negotiable for ubuntu 24.04 server hardening. Deny all incoming traffic by default, and only allow the specific ports your server needs. For advanced network architectures involving routing and strict boundary firewalls, you might want to explore how to install pfSense on VirtualBox to create isolated test networks.

A core aspect of ubuntu 24.04 server hardening is keeping all software packages up to date.

Enable UFW and set the default policies:

1
2
sudo ufw default deny incoming

sudo ufw default allow outgoing

Allow your custom SSH port (e.g., 2244). If you are running a web server, allow HTTP and HTTPS:

1
2
3
sudo ufw allow 2244/tcp

sudo ufw allow 80/tcp

sudo ufw allow 443/tcp

Enable the firewall:

1
sudo ufw enable

Check the status to confirm your rules:

1
sudo ufw status verbose

AppArmor Configuration and Profiles

AppArmor is a Mandatory Access Control (MAC) system that confines programs to a limited set of resources. Proper apparmor configuration ubuntu administrators deploy ensures that even if an application is compromised, the attacker cannot access the rest of the system.

During the process of ubuntu 24.04 server hardening, always verify your firewall rules carefully.

First, verify that AppArmor is installed, active, and enforcing:

1
2
3
4
sudo apt install apparmor apparmor-utils -y

sudo systemctl enable apparmor

sudo systemctl start apparmor

sudo aa-status

Most default Ubuntu packages come with AppArmor profiles. To put all profiles into enforce mode, run:

1
sudo aa-enforce /etc/apparmor.d/*

If an application starts misbehaving, you can check the logs in

or

for AppArmor “DENIED” messages and adjust the profiles accordingly using

.

Automatic Security Updates (Unattended-Upgrades)

Manual patching often leads to delayed updates, leaving servers vulnerable to known exploits. Configuring ubuntu unattended upgrades guarantees that critical security patches are applied automatically as soon as Canonical releases them.

Mastering ubuntu 24.04 server hardening will significantly reduce the attack surface of your infrastructure.

Install the necessary package:

1
sudo apt install unattended-upgrades apt-listchanges -y

Configure the upgrades by running the interactive setup:

1
sudo dpkg-reconfigure -plow unattended-upgrades

Select “Yes” to automatically download and install stable updates. Next, fine-tune the configuration file to ensure only security updates are applied automatically:

1
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Ensure the security origin is uncommented:

1
2
3
4
5
6
Unattended-Upgrade::Allowed-Origins {

    "${distro_id}:${distro_codename}";

    "${distro_id}:${distro_codename}-security";

    "${distro_id}ESMApps:${distro_codename}-apps-security";

    "${distro_id}ESM:${distro_codename}-infra-security";

};

You can also configure the system to auto-reboot at a specific time if a kernel update requires it:

1
2
Unattended-Upgrade::Automatic-Reboot "true";

Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Audit Logging with Auditd

To detect and investigate security incidents, you need comprehensive logging. Standard syslog is good, but audit logging linux tools like

Regular audits are a mandatory part of ubuntu 24.04 server hardening to catch misconfigurations early.

provide kernel-level tracking of system calls and file access.

Install the audit daemon:

1
sudo apt install auditd audispd-plugins -y

Enable and start the service:

1
2
sudo systemctl enable auditd

sudo systemctl start auditd

To monitor critical files, such as your SSH configuration or password files, add custom rules:

1
sudo nano /etc/audit/rules.d/custom.rules

Add the following lines to log any modifications to user accounts or SSH configs:

1
2
3
-w /etc/passwd -p wa -k passwd_changes

-w /etc/shadow -p wa -k shadow_changes

-w /etc/ssh/sshd_config -p wa -k sshd_config_changes

Restart the daemon to apply the rules:

1
sudo systemctl restart auditd

You can search your audit logs using the

command (e.g.,

).

File System Security: Permissions and SUID/SGID Audit

Improper file permissions can lead to privilege escalation. Regularly audit your system for files with the SUID or SGID bit set, as these run with elevated privileges:

If you are serious about ubuntu 24.04 server hardening, automation can help maintain consistency across deployments.

1
2
sudo find / -perm /4000 -type f 2>/dev/null

sudo find / -perm /2000 -type f 2>/dev/null

Review the output carefully. Remove the SUID/SGID bit from any binary that does not absolutely require it:

1
sudo chmod u-s /path/to/unnecessary/suid/binary

Additionally, ensure sensitive directories have proper permissions:

1
2
3
sudo chmod 700 /root

sudo chmod 600 /etc/shadow

sudo chmod 644 /etc/passwd

Network Hardening: Sysctl and IPv6

Harden your network stack by tuning kernel parameters. Edit

:

1
sudo nano /etc/sysctl.conf

Add or uncomment the following lines:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# Disable IP forwarding (unless this is a router)

net.ipv4.ip_forward = 0



# Disable ICMP redirects

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0



# Enable SYN flood protection

net.ipv4.tcp_syncookies = 1



# Log suspicious packets

net.ipv4.conf.all.log_martians = 1



# Disable IPv6 if not needed

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

Apply the changes:

1
sudo sysctl -p

Monitoring and Intrusion Detection

For ongoing security monitoring, consider installing lightweight intrusion detection tools:

AIDE (Advanced Intrusion Detection Environment)

AIDE creates a database of file checksums and alerts you when system files are modified:

1
2
3
sudo apt install aide -y

sudo aideinit

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Run periodic checks:

1
sudo aide --check

Lynis Security Auditing

Lynis performs a comprehensive security audit and provides a hardening score:

1
2
sudo apt install lynis -y

sudo lynis audit system

Review the output and address any warnings or suggestions.

Ubuntu 24.04 Server Hardening Checklist

Use this summary checklist to verify your hardening steps are complete:

• ✅ System fully updated with latest patches
• ✅ HWE kernel 6.17 installed and active
• ✅ Root account locked, sudo user configured
• ✅ SSH: Key-based auth only, root login disabled, custom port
• ✅ Fail2Ban protecting SSH
• ✅ UFW firewall enabled with minimal open ports
• ✅ AppArmor profiles in enforce mode
• ✅ Unattended security upgrades configured
• ✅ Auditd logging critical file changes
• ✅ SUID/SGID binaries audited
• ✅ Network stack hardened via sysctl
• ✅ AIDE or Lynis installed for ongoing monitoring

Frequently Asked Questions (FAQ)

Q: How often should I run a security audit?
A: At minimum monthly, or after any major system change. Automate Lynis scans via cron for continuous monitoring.

Q: Will these hardening steps break my applications?
A: Some applications may require specific ports or permissions. Test each change in a staging environment first. AppArmor in complain mode can help identify issues before enforcing.

Q: Should I disable IPv6 on all servers?
A: Only if you are not using IPv6. Some cloud providers and modern services require it. Disabling unused protocols simply reduces your attack surface.

Q: Is UFW sufficient or should I use iptables directly?
A: UFW is a frontend for iptables/nftables and is sufficient for most use cases. For complex multi-zone firewall rules, consider direct nftables configuration.

Conclusion

Completing a thorough ubuntu 24.04 server hardening process is not optional in 2026 — it is essential. By following this guide, you have secured SSH access, configured a strict firewall, enabled mandatory access controls with AppArmor, set up automatic security patching, and implemented comprehensive audit logging. Your Ubuntu 24.04 LTS server is now significantly more resilient against modern threats. Remember that security is an ongoing process: keep your system updated, review logs regularly, and re-audit after any configuration change. Stay safe out there!

This concludes our comprehensive guide on ubuntu 24.04 server hardening. Remember that ubuntu 24.04 server hardening is an ongoing process, not a one-time setup.

• About the Author
• Latest Posts

Mark

Mark is a senior content editor at Text-Center.com and has more than 20 years of experience with linux and windows operating systems. He also writes for Biteno.com

• Ubuntu 24.04 Server Hardening Guide (2026)
• How to upgrade to Ubuntu 24.04.4 (LTS & HWE Guide 2026)
• Installing Visual Studio Code on Apple Macintosh