A compact checklist for hardening a fresh Ubuntu 22.04 server. These steps cover the essentials — from SSH lockdown to automatic updates.

SSH

• Disable password authentication — use key-based auth only:

  PasswordAuthentication no
  

• Disable root login:

  PermitRootLogin no
  

• Restrict to IPv4 if you don’t need IPv6:

  AddressFamily inet
  

• Disable X11 forwarding:

  X11Forwarding no
  

• Reload after changes: sudo systemctl reload sshd

Firewall (UFW)

• Enable UFW and allow only what you need:

You’ve hardened your server — SSH keys, firewall, fail2ban, automatic updates. But how do you know what you missed? Lynis is an open-source security auditing tool that scans your system and tells you exactly where to improve.

What Lynis Does

Lynis performs hundreds of individual tests across your system: kernel settings, authentication, file permissions, network configuration, running services, and more. It produces a hardening index (0–100) and a list of concrete suggestions with references to specific controls.