Production-Ready Linux Server Hardening

This project demonstrates the deployment and hardening of a cloud-based Ubuntu server to mimic a professional production environment.

Tech Stack

• Cloud: AWS (EC2)
• OS: Ubuntu 24.04 LTS
• Security: UFW, Fail2Ban, OpenSSH

Hardening Steps Implemented

1. Identity & Access Management

• **created a non-root user with sudo privileges * **
• Disabled Root Login: Prevented direct root access to mitigate high-impact attacks.
• Key-Based Authentication: Enforced Ed25519 SSH keys and disabled password logins.

• Initial SSH Key Setup

  Before running the hardening script, key-based authentication must be established between the local machine and the server:

  Run this on your LOCAL LAPTOP

   ssh-keygen -t ed25519 -C "your_email@example.com"
  

  Run this on the SERVER to prepare the key folder

   mkdir -p ~/.ssh
   chmod 700 ~/.ssh
   touch ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys
  

2. Network Security

• UFW Firewall: Configured a "Default Deny" policy, allowing only Port 22.
• Fail2Ban: Automated IP banning for brute-force detection.

3. System Maintenance

• Unattended-Upgrades: Enabled automatic daily security patches.

Verification & Monitoring

To ensure the hardening measures are active, I implemented real-time monitoring:

1. Intrusion Prevention (Fail2Ban)

The following shows the Fail2Ban service active and monitoring SSH login attempts:

2. Firewall Status (UFW)

The firewall is configured to a "Default Deny" state, only allowing traffic on Port 22: