ADVERTISEMENT

Secure Your Ubuntu 24.04 Web Server: Ultimate 10-Step Checklist

So, you’ve got a shiny new Ubuntu 24.04 server ready for action. Before launching your web applications, let’s make sure your setup is rock-solid secure. With this 10-step guide, we’ll keep those pesky hackers at bay. Ready? Let’s dive in!

Step 1: Update Your Server

First things first, updating your server is crucial. Open your terminal and type:

sudo apt update && sudo apt upgrade

This ensures you get the latest security patches and system updates.

Step 2: Set Up a Firewall

To keep unwanted traffic out, set up a firewall. Ubuntu comes with UFW (Uncomplicated Firewall). Enable it by running:

sudo ufw enable

You can allow connections only to specific ports, for instance, SSH (22), HTTP (80), and HTTPS (443) using commands like:

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Step 3: Disable Root Login

For added security, disable direct root login. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find the line PermitRootLogin and set it to no. Restart SSH:

sudo systemctl restart ssh

Step 4: Change the Default SSH Port

Changing the default SSH port can help hide your server from automated attacks. Again, edit:

sudo nano /etc/ssh/sshd_config

Find #Port 22 and change it to something like Port 2222. Remember to allow the new port in your firewall:

sudo ufw allow 2222/tcp

After all changes, restart SSH.

Step 5: Install Fail2ban

Fail2ban helps prevent brute-force attacks. Install it with:

sudo apt install fail2ban

It monitors log files and bans IPs that show malicious signs.

Step 6: Use SSH Keys

Switch to SSH keys from password login to add a layer of security. Generate a key pair using:

ssh-keygen -t rsa

Add the public key to your server with:

ssh-copy-id user@your-server-IP

Step 7: Monitor and Log Events

Keep logs of all activities using tools like rsyslog or syslog-ng. They help in detecting suspicious activities.

Step 8: Secure Web Applications

Ensure that the applications you host follow security best practices. Regularly update them and consider using tools like Certbot for SSL.

Step 9: Perform Regular Backups

Back up your server data regularly. Options include using DigitalOcean tutorials for cloud backups. It ensures you have a restore point in case of data loss.

Step 10: Keep Learning

Security is ever-changing. Stay informed with community forums, and don’t hesitate to ask for advice when needed. Knowledge is your best defense!