Ubuntu 24.04: hardening beyond SSH
Our "10 steps" guide covers the essentials. This one goes further: kernel settings and habits that separate a decent server from a truly hardened one.
sysctl: the network layer
In /etc/sysctl.d/99-hardening.conf:
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0SYN flood protection, anti-spoofing, and ICMP redirect refusal — the basic trio against simple network attacks.
Automatic updates, properly configured
unattended-upgrades with security updates only, a planned nightly reboot if needed (Automatic-Reboot-Time "03:30"), and an alert channel. 60% of compromises exploit CVEs patched weeks earlier.
AppArmor: free containment
Ubuntu ships AppArmor: confine your exposed services (Nginx, MySQL) with the provided profiles. An application flaw then becomes harmless — the process can't read anything outside its perimeter.
Persistent journald and auditd
Switch journald to persistent storage (Storage=persistent), install auditd to trace changes to sensitive files (/etc/passwd, SSH keys), and export logs to a second VPS. An attacker wiping local traces can't wipe your remote logs.
Ongoing hygiene
A quarterly 15-minute audit: ss -tlnp, sudo users, active crons, installed packages. Security is a habit, not a project.