Ubuntu Security Hardening

BY | Jun 4, 2026 | Operating Systems

Ubuntu Security Hardening Guide for 2026

Ubuntu is one of the most popular Linux distributions for servers and desktops, but default installations are not fully secure. Properly hardening your Ubuntu systems in 2026 is essential for both homelab and production environments.

This guide covers the most important and practical security hardening steps.

Why Hardening Matters

Reduced Attack Surface

Default Ubuntu installations expose many unnecessary services and open ports that attackers actively scan for.

Protection Against Automated Attacks

Bots constantly probe the internet for vulnerable Ubuntu systems. Basic hardening stops the majority of them.

Improved System Resilience

Hardening makes it significantly harder for attackers to escalate privileges or persist on a compromised system.

Essential Security Hardening Steps

Step 1

Keep the System Updated

Apply security updates regularly and enable automatic security updates.

sudo apt update && sudo apt upgrade -y
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades

Step 2

Configure the Firewall (UFW)

Enable UFW and only allow the ports you actually need.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Step 3

Harden SSH Access

Disable root login and password authentication. Use SSH keys only.

sudo nano /etc/ssh/sshd_config

# Recommended settings:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart ssh

Step 4

Install and Configure Fail2Ban

Protect against brute-force attacks by automatically banning malicious IPs.

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

Step 5

Enable AppArmor (Default on Ubuntu)

AppArmor is Ubuntu’s default Mandatory Access Control system. It restricts what programs can do on the system.

sudo apt install apparmor apparmor-utils -y
sudo systemctl enable --now apparmor
sudo aa-status

Step 6

Create a Non-Root User

Avoid using the root account for daily work. Create a regular user with sudo access.

sudo adduser yourusername
sudo usermod -aG sudo yourusername

Step 7

Kernel Parameter Hardening (sysctl)

Harden the kernel by disabling unnecessary features and improving protection against common attacks.

Kernel Hardening

kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
kernel.unprivileged_userns_clone = 0
kernel.yama.ptrace_scope = 1

Network Hardening

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1

File System Security

fs.protected_hardlinks = 1
fs.protected_symlinks = 1

sudo sysctl -p /etc/sysctl.d/99-security.conf

Advanced: SELinux on Ubuntu

SELinux vs AppArmor

While Ubuntu ships with AppArmor by default, you can install SELinux for more granular and powerful Mandatory Access Control. SELinux is more common in enterprise environments (RHEL, CentOS, Rocky Linux) but can be used on Ubuntu.

When to Consider SELinux

Use SELinux if you need stronger confinement, work in highly regulated environments, or want policy-based access control beyond what AppArmor offers.

Basic SELinux Installation on Ubuntu

SELinux can be installed, but it requires more configuration and can be complex on Ubuntu.

sudo apt install selinux-basics selinux-policy-default auditd -y
sudo selinux-activate

After installation, reboot and set enforcing mode:

sudo setenforce 1

Additional Recommendations

Enable Automatic Reboots After Updates

Configure unattended-upgrades to automatically reboot when required for security updates.

Regular Security Auditing

Use tools like Lynis to regularly audit your system’s security configuration.

Implement a Backup Strategy

Follow the 3-2-1 backup rule. Even hardened systems can fail or be compromised.

Questions for the Community

What hardening steps do you use?

Which security practices have you implemented on your Ubuntu systems?

AppArmor vs SELinux

Do you prefer AppArmor or have you used SELinux on Ubuntu? What was your experience?

Biggest Lesson

What security mistake or oversight taught you the most when running Ubuntu?

Disclaimer

This content is for educational and informational purposes only. It is not technical advice. Always test security configurations thoroughly in your own environment before applying them to production systems.

DISCUSSION

No replies yet. Be the first to join the discussion!