A staged approach to Ubuntu server hardening

Start with recoverability

Hardening changes access and service behavior. Before applying restrictive controls, confirm that you have an approved administrator account, a second access path where appropriate, a current backup or snapshot, and a documented rollback method.

Establish the baseline

Record the operating-system release, listening ports, enabled services, administrative users, firewall state, update state, storage usage, and application dependencies. A baseline helps distinguish a security improvement from an accidental outage.

Reduce exposed services

Only expose ports that serve a documented purpose. For a typical public web server, application ports should remain private behind the reverse proxy, while HTTPS is public and administrative access is restricted to trusted sources whenever practical.

Strengthen administrative access

• Use named administrative accounts rather than routine direct root login.
• Prefer strong key-based SSH authentication.
• Protect private keys and remove unused authorized keys.
• Review sudo access and inactive accounts.
• Test a second session before closing the current administrative connection.

Maintain the system

Apply supported security updates, remove unused packages, review service startup, and restart services deliberately. Automatic updates can reduce exposure, but their behavior should be understood and monitored on important application servers.

Protect the application layer

Terminate HTTPS correctly, set restrictive file permissions, keep secrets out of repositories and logs, isolate database access, use secure cookies, and review application-specific security guidance.

Logging and detection

Keep authentication, firewall, reverse-proxy, application, and system logs available long enough to investigate failures. Alerts should focus on signals an operator can act on rather than generating noise.

Verify after every stage

Recheck administrative access, public application access, required background services, listening ports, certificates, scheduled backups, and reboot persistence. Hardening is complete only when the intended service still works and the recovery path remains usable.