Ubuntu Server Hardening

Activation Contract

Create or apply this skill when:

• The user needs to secure a new Ubuntu Server (headless or not).
• The user wants to apply standard hardening (SSH, Firewall, Auditing).
• Preparing a server for software installation (like ForgeOS) that requires a secure base.

Hard Rules

• NEVER close the current SSH session while modifying network or SSH configurations until a second session confirms access.
• Use Ed25519 keys; do not use RSA keys under 3072 bits.
• SSH PermitRootLogin must be no.
• SSH PasswordAuthentication must be no.
• Firewall (UFW) must default deny incoming, allow outgoing, and explicitly allow SSH (port 22).

Decision Gates

Execution Steps

1. SSH Hardening:

   • Verify client has Ed25519 keys (ssh-keygen -t ed25519).
   • Transfer key to server (ssh-copy-id user@server).
   • Edit /etc/ssh/sshd_config to set PermitRootLogin no, PasswordAuthentication no, PermitEmptyPasswords no.
   • Validate sshd (sudo sshd -t) and restart (sudo systemctl restart ssh).

2. Firewall (UFW):

   • Run sudo ufw default deny incoming.
   • Run sudo ufw default allow outgoing.
   • Run sudo ufw allow ssh.
   • Run sudo ufw enable.

3. Intrusion Prevention (Fail2Ban):

   • Install fail2ban (sudo apt install fail2ban -y).
   • Enable and start the service (sudo systemctl enable fail2ban && sudo systemctl start fail2ban).

4. Updates:

   • Update system: sudo apt update && sudo apt upgrade -y.
   • Enable automatic security updates: sudo apt install unattended-upgrades -y.

Output Contract

Return:

• A confirmation of the steps executed or a checklist for the user to execute.
• Warning regarding testing SSH access on a new terminal before closing the current one.
• Any ports that need to be opened manually for additional software.