Aerostat’s Guide To Linux (standalone)

Portable summary of the project’s Ubuntu hardening guide for readers who prefer plain Markdown outside the Jekyll site.

Canonical web version: index.md · https://binarylawyer.github.io/Linux_Guide/

Version 1.1 — Ubuntu 22.04 LTS focus (also applicable to current LTS releases)

Goals

Stand up a fresh Ubuntu LTS server safely
Apply a practical hardening baseline (SSH, firewall, updates, users, logging)
Know when PaaS (Vercel and similar) is no longer enough
Leave checklists you can reuse and improve

Quick start checklist

Install Ubuntu LTS (22.04 or 24.04) and fully update packages.
Set hostname, timezone, and enable NTP (systemd-timesyncd).
Create a non-root sudo user; install your SSH public key.
Disable root SSH login and password authentication.
Enable UFW; allow only required ports (start with OpenSSH).
Install and enable fail2ban.
Turn on unattended security updates.
Confirm backups and a tested restore path.

Core commands

# Updates
sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y

# Admin user
sudo adduser youradmin
sudo usermod -aG sudo youradmin

# Firewall
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

# Intrusion prevention
sudo apt install fail2ban
sudo systemctl enable --now fail2ban

# Automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

SSH baseline (`/etc/ssh/sshd_config`)

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers youradmin
X11Forwarding no

sudo sshd -t && sudo systemctl reload ssh

Prefer Ed25519 keys. Consider 2FA (libpam-google-authenticator) on high-value hosts.

Encrypt traffic

Use ssh, scp, sftp, and rsync over SSH. Prefer HTTPS/TLS (Let’s Encrypt) for services. Avoid telnet and plain FTP on public networks.

Extra hardening (see full guide)

The full index.md also covers:

Kernel sysctl hardening and boot//boot locks
Password policy, sudo, and inactive account locks
TLS testing, AIDE, auditd, Lynis, rkhunter
Log management (rsyslog, journald, logrotate)
Container (Docker) security basics
When to move from Vercel / PaaS to a self-managed server (cost, control, stateful workloads, migration checklist)

PaaS → self-managed (rule of thumb)

Once a PaaS bill is consistently about $50–$100+/month, or you need custom networking, long-running processes, or portable infra, evaluate a VPS and follow the migration checklist in the full guide.

Contributing

Improvements welcome via pull request. Earlier mixed template/content is archived in index-backup-1.md.