How to Harden Ubuntu 24.04 Server Security in 2026

Ubuntu 24.04 LTS introduced new security defaults but there is still much to configure for production hardening. This 2026 guide covers the complete checklist.

Step 1 — Update Everything First

apt update && apt upgrade -y
apt autoremove -y

Step 2 — Harden SSH

nano /etc/ssh/sshd_config.d/hardening.conf

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
LoginGraceTime 20
AllowAgentForwarding no
X11Forwarding no

systemctl restart ssh

Step 3 — Configure UFW

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 443/udp  # HTTP/3 QUIC
ufw enable

Step 4 — Kernel Hardening

nano /etc/sysctl.d/99-hardening.conf

kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

sysctl -p /etc/sysctl.d/99-hardening.conf

Step 5 — Install and Configure Fail2Ban

apt install fail2ban -y
systemctl enable fail2ban --now

Step 6 — Enable Unattended Security Updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

Step 7 — Run Lynis Audit

apt install lynis -y
lynis audit system --quick

Aim for a hardening index above 75.

Conclusion

Security hardening is an ongoing process. Our team provides professional security audits and hardening with detailed remediation reports.