Ubuntu Security Hardening

Table of Contents

1. Challenge

   Harden SSH Access and Validate with fail2ban

   To start things off, you will generate an ED25519 SSH key pair with ssh-keygen and install it for the auditor user, then harden the SSH daemon by writing a drop-in under /etc/ssh/sshd_config.d/ that disables root login, disables password authentication, enforces an AllowUsers allow-list, and tightens MaxAuthTries and LoginGraceTime. You will validate the configuration with sshd -t and sshd -T, prove the policy with positive and negative login tests against /var/log/auth.log, and finally configure fail2ban with production-grade jail values so the system can defend itself against brute-force attempts.

2. Challenge

   Enable UFW, Configure auditd, and Correlate Security Events

   Next, you will stand up a host firewall by setting deny-by-default inbound with ufw, opening only the ports the dashboard needs, applying SSH rate-limiting with ufw limit, and confirming the rules survive a ufw reload. You will then write audit rules under /etc/audit/rules.d/ that watch /etc/passwd, /etc/shadow, and /var/log/auth.log for changes and log every execve of /usr/bin/sudo, load them with augenrules --load, trigger each event class, and correlate the trail both live with journalctl -f and retrospectively with ausearch, aureport, journalctl, and the auth log.

3. Challenge

   Manage AppArmor Profiles and Review Denial Logs

   To finish things off, you will manage mandatory access control profiles with AppArmor. You will inspect the live posture with aa-status, view the custom nginx profile, switch it between complain and enforce modes using aa-complain and aa-enforce, and run a rogue script under the profile with aa-exec to watch the kernel block forbidden operations. You will inspect the audit subsystem with ausearch -m AVC for the forensic trail, and close out by practicing the aa-logprof interactive refinement workflow used in production to tune real profiles against real workloads.