Hardening Linux Cloud Servers: SSH Keys, UFW Firewalls, and Fail2ban

The moment a public IP address is assigned to a newly provisioned Linux virtual machine, automated scanning scripts and botnets begin bombarding port 22 with dictionary attacks. Leaving a server running default configurations with password authentication enabled is a catastrophic security risk. Hardening a fresh Linux server requires following a disciplined defense-in-depth protocol.

1. Secure SSH Configuration

OpenSSH is the front door of your remote server. Lock it down immediately via /etc/ssh/sshd_config:

• Enforce Ed25519 SSH Key Authentication: Generate modern Ed25519 cryptographic keys (ssh-keygen -t ed25519), which offer superior performance and resistance to side-channel attacks compared to legacy RSA.
• Disable Password Authentication: Set PasswordAuthentication no. This completely neutralizes brute-force password guessing attacks.
• Disable Root Login: Set PermitRootLogin no. Force operators to authenticate via an unprivileged user account and elevate via sudo, preserving full audit logs.
• Change Default Port (Optional Defense): Changing port 22 to a non-standard high port (e.g., 22222) eliminates 98% of low-effort automated botnet noise from your authentication logs.

2. Host-Level Packet Filtering with UFW (Uncomplicated Firewall)

Linux features powerful native kernel packet filtering via Netfilter/iptables. UFW provides an intuitive command-line abstraction to enforce a strict default-deny firewall posture:

1. Default Policy: Deny all incoming traffic and allow all outbound traffic: sudo ufw default deny incoming and sudo ufw default allow outgoing.
2. Allow Custom SSH: sudo ufw allow 22222/tcp comment 'SSH'.
3. Allow Web Traffic: If hosting a web server, allow ports 80 and 443: sudo ufw allow 80/tcp and sudo ufw allow 443/tcp.
4. Enable Firewall: Activate the rules: sudo ufw enable.

3. Automated Intrusion Prevention: Fail2ban

Fail2ban inspects system authentication logs (such as /var/log/auth.log) in real time. When an IP address exhibits suspicious behavior—such as five failed authentication attempts within ten minutes—Fail2ban automatically injects an iptables drop rule banning that IP for 24 hours.

4. Automated Security Patching: Unattended Upgrades

Zero-day vulnerabilities in common packages like OpenSSL or the Linux kernel are regularly discovered. On Debian and Ubuntu systems, install and configure unattended-upgrades to automatically download and apply critical security hotfixes in the background without requiring manual intervention.

Summary Sysadmin Checklist

Securing a Linux server is not about complex commercial software; it is about eliminating unauthenticated entry points, enforcing public-key cryptography, minimizing exposed ports, and keeping kernel patches up to date. Implement these foundational measures on day one to safeguard your digital infrastructure.