Production Linux Server Hardening Checklist: SSH, UFW, Fail2ban & CIS Benchmarks

1. Step 1: Cryptographic SSH Key Enforcement

Disable all password-based SSH authentication and force modern elliptic curve keys in /etc/ssh/sshd_config:

# /etc/ssh/sshd_config Hardening
PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin prohibit-password
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

Generate keys using ssh-keygen -t ed25519 -a 100 on your local workstation and verify connection before restarting the SSH daemon.

2. Step 2: Uncomplicated Firewall (UFW) Ingress Isolation

Enforce a strict default-deny ingress policy and expose only necessary public web services:

# Reset and enforce default deny
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Restrict SSH to custom management subnet if applicable
sudo ufw allow 22/tcp
# Enable and inspect
sudo ufw enable
sudo ufw status verbose

3. Step 3: Automated Rate Limiting with Fail2ban

Configure Fail2ban to monitor authentication logs and Nginx HTTP error streams, automatically dropping offending IP addresses via iptables:

# /etc/fail2ban/jail.local
[DEFAULT]
bantime = 86400
findtime = 600
maxretry = 3
banaction = ufw
[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log

4. Step 4: CIS Auditing & Unattended Security Upgrades

Enable automatic unattended security patching and perform periodic compliance auditing:

# Enable security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
# Install and execute Lynis system audit
sudo apt install lynis
sudo lynis audit system