How to Harden Linux Servers (Ubuntu/CentOS) Against Brute-Force Attacks Securing your Linux infrastructure is essential for maintaining business continuity and protecting sensitive data. If your servers run public-facing services like SSH, they are constantly
How to Harden Linux Servers (Ubuntu/CentOS) Against Brute-Force Attacks
Securing your Linux infrastructure is essential for maintaining business continuity and protecting sensitive data. If your servers run public-facing services like SSH, they are constantly exposed to automated botnets and malicious actors attempting unauthorized access through brute-force attacks. Whether you are managing an Ubuntu or CentOS environment, implementing a robust multi-layered security strategy is vital.
To directly answer the core question: The most effective way to harden a Linux server against brute-force attacks is to disable password-based authentication in favor of SSH keys, restrict root access, change the default SSH port, and deploy automated intrusion prevention tools like Fail2ban alongside a properly configured firewall.
In this comprehensive guide, we will walk you through actionable, step-by-step techniques to fortify your Ubuntu and CentOS servers against these pervasive security threats.
1. Implement SSH Key-Based Authentication and Disable Passwords
Standard password authentication leaves your server vulnerable to credential stuffing and brute-force guessing. Cryptographic SSH keys provide a significantly more secure alternative because they rely on public-key cryptography.
Step 1: Generate an SSH Key Pair
On your local machine, generate a secure SSH key pair using the terminal:
Step 2: Copy the Public Key to the Server
Transfer your public key to the remote Linux server:
Step 3: Modify the SSH Configuration
Open the SSH daemon configuration file using your preferred text editor (e.g., sudo nano /etc/ssh/sshd_config) and ensure the following directives are set:
- PubkeyAuthentication yes
- PasswordAuthentication no
- PermitRootLogin no
After saving the file, restart the SSH service to apply changes. On Ubuntu, run sudo systemctl restart ssh, and on CentOS, run sudo systemctl restart sshd.
2. Configure and Optimize Fail2ban for Intrusion Prevention
Even with passwords disabled, malicious bots will flood your authentication logs with connection attempts. Fail2ban is an intrusion prevention software framework that monitors log files for malicious activity and updates firewall rules to ban IP addresses exhibiting malicious behavior.
Installation:
- Ubuntu / Debian: sudo apt update && sudo apt install fail2ban
- CentOS / RHEL: Requires the EPEL repository first: sudo dnf install epel-release && sudo dnf install fail2ban
Configuration Best Practices:
Never edit the default jail.conf file directly, as updates may overwrite your changes. Instead, create a local copy:
Open /etc/fail2ban/jail.local and adjust parameters such as:
- bantime: Duration an IP is banned (e.g., 1h or 1d).
- findtime: The window of time during which failures must occur before a ban (e.g., 10m).
- maxretry: The number of failures before a host is banned (e.g., 3 or 5).
Enable and start the service:
sudo systemctl enable --now fail2ban3. Lock Down Network Ports Using UFW or Firewalld
Minimizing your server's attack surface means closing unnecessary ports and strictly controlling incoming traffic. Depending on your Linux distribution, you will use either UFW (Uncomplicated Firewall, standard on Ubuntu) or Firewalld (standard on CentOS).
Using UFW (Ubuntu):
- Set default policies: sudo ufw default deny incoming and sudo ufw default allow outgoing.
- Allow required services only: sudo ufw allow 22/tcp (or your custom SSH port) and sudo ufw allow 80,443/tcp for web traffic.
- Enable the firewall: sudo ufw enable.
Using Firewalld (CentOS):
- Check firewall status: sudo firewall-cmd --state.
- Allow specific services permanently: sudo firewall-cmd --permanent --add-service=ssh.
- Reload the firewall rules: sudo firewall-cmd --reload.
4. Establish Proactive Server Monitoring and Log Auditing
Hardening is not a one-time task; it requires ongoing vigilance. Regularly reviewing system logs helps you identify targeted attack patterns before they compromise your system.
- Monitor authentication logs located at /var/log/auth.log (Ubuntu) or /var/log/secure (CentOS).
- Consider configuring automated security notification tools or centralized log management systems to alert administrators of repeated failed login attempts from specific geographic regions or IP ranges.
- At MSN Brothers (Private) Limited, established in 2024, our IT division assists organizations with specialized hosting solutions, custom software development, and ERP systems, helping businesses maintain robust, secure digital architectures tailored to their operational workflows.
Frequently Asked Questions
1. Is changing the default SSH port (port 22) necessary?
While changing the default SSH port is not a complete security solution on its own, it significantly reduces the volume of automated log entries and brute-force botnet traffic targeting standard ports. It should be used as part of a defense-in-depth strategy alongside SSH keys and firewalls.
2. What happens if I accidentally lock myself out of my server?
If you disable password authentication and misconfigure your SSH keys or firewall, you may lose access. Most cloud hosting providers and dedicated server vendors offer an out-of-band management console (such as a VNC console, KVM, or rescue mode) that allows you to log in directly via the provider's web interface to fix configuration errors.
3. Can Fail2ban block legitimate users?
Yes, if a legitimate user or administrator enters their password incorrectly too many times within the configured findtime window, Fail2ban will temporarily ban their IP address. You can prevent this by adding trusted administrator IP addresses to the ignoreip directive in your jail.local file.
4. How often should I update my Linux server packages?
Security patches should be applied regularly. For critical security vulnerabilities, packages should be updated as soon as patches become available. Setting up automated unattended security upgrades on Ubuntu or regular package audits on CentOS ensures your kernel and packages remain patched against known exploits.
Secure Your Infrastructure with Professional IT Support
Implementing strong security baselines on Ubuntu and CentOS environments protects your applications, customer data, and brand reputation from automated threats. If your organization requires expert assistance with secure server setup, cloud hosting infrastructure, custom software integration, or AI automation solutions, MSN Brothers (Private) Limited is here to help.
Contact us today to discuss how our professional IT services can support your business infrastructure securely and efficiently.