Hardening SSH on Ubuntu 24.04: The 6 Things That Actually Matter

When it comes to securing SSH on Ubuntu 24.04, there are six crucial steps that truly matter, and they should be carried out in a specific order for optimal results. First and foremost, generate a key-only authentication method. Generate a key pair, copy the public key to the server, and then connect using the key to verify it functions properly.

After confirming the key works, disable password authentication entirely. Next, consider the cloud-image specific issue. On Ubuntu cloud images such as those used by AWS or DigitalOcean, there's a configuration file located at /etc/ssh/sshd_config.d/60-cloudimg-settings.conf. This file can override settings in the main sshd_config file.

To avoid conflicts, place your hardening configuration in /etc/ssh/sshd_config.d/10-hardening.conf instead. The system reads these drop-in files alphabetically, so the one with a lower number takes precedence. The next step involves disabling root login. With sudo privileges already available, there's no need to allow direct root access via SSH.

Moving on, change the default SSH port from 22. While security through obscurity isn't foolproof, changing the port can significantly reduce automated brute-force attacks, making logs more manageable and fail2ban's job easier. Following that, install fail2ban with its default settings using the command sudo apt install fail2ban.

Verify that fail2ban is running by executing sudo fail2ban-client status sshd. Lastly, ensure automatic security updates are in place by installing unattended-upgrades and configuring it with sudo apt install unattended-upgrades and sudo dpkg-reconfigure -plow unattended-upgrades. While this provides a quick and effective emergency lockdown, a more comprehensive guide with 46 checkpoints can be found in the Linux Server Hardening Checklist, which covers various aspects such as users, firewall, kernel tweaks, file permissions, and log monitoring.