Hardening SSH and Configuring UFW Firewall on Ubuntu 24.04 LTS

Why Server Hardening Is the First Priority

Publicly reachable Linux servers are scanned by automated botnets within minutes of receiving an IP address. Leaving password authentication enabled on default SSH ports invites brute-force credential stuffing. Here is the verified hardening sequence for Ubuntu.

Step 1: Generate an Ed25519 SSH Key Pair

On your local computer (not the server), generate an Ed25519 key pair with a passphrase:

ssh-keygen -t ed25519 -C "admin@newssparx"

Copy your public key to the remote Ubuntu server:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-server-ip

Step 2: Hardening sshd_config

Connect to the server and edit the SSH configuration at /etc/ssh/sshd_config.d/50-cloud-init.conf or /etc/ssh/sshd_config:

# Disable root login over SSH
PermitRootLogin no

# Enforce public key authentication only
PasswordAuthentication no
PubkeyAuthentication yes

# Disable empty passwords
PermitEmptyPasswords no

# Limit maximum authentication tries
MaxAuthTries 3

Test the SSH syntax before restarting the daemon to prevent lockouts:

sudo sshd -t && sudo systemctl restart ssh

Step 3: Configuring the UFW Firewall

Configure Uncomplicated Firewall (UFW) with strict defaults:

# Set default policies: block incoming, allow outgoing
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow and rate-limit SSH connections
sudo ufw limit 22/tcp comment "Rate-limited SSH"

# Allow web traffic if hosting public services
sudo ufw allow 80/tcp comment "HTTP"
sudo ufw allow 443/tcp comment "HTTPS"

# Enable the firewall
sudo ufw enable
sudo ufw status verbose

Keep your current SSH window open and test connecting from a second terminal window to verify successful key-based login.