Harden a Server
Turn on Fail2Ban, a firewall and safer SSH settings with one playbook, starting with a dry run, without losing SSH access to the server.
Before you start: A connected server running Ubuntu 22.04 or later, Debian 12 or later, RHEL-compatible 8 or later, or Amazon Linux 2023 with Fail2Ban turned off.
- 1
Open the Advanced Security playbook
Playbooks is under Automation. Advanced Security: Fail2Ban & Firewall Hardening is in the Security group.
- 2
Choose the firewall and ports
Firewall either turns on the firewall, allowing SSH and the ports you list, or leaves it as it is. Allow ports that services are listening on now keeps everything reachable today reachable; turn it off to allow only SSH and Also allow these ports, such as 80 and 443. SSH is always allowed.
- 3
Set up Fail2Ban
Install Fail2Ban for SSH is on by default. Fail2Ban rule sets how quickly an address is banned and for how long. Add office or VPN addresses to Never ban these addresses; the address the platform connects from is always included.
- 4
Decide on SSH logins
Apply safe SSH settings does not change how anyone signs in. Password logins and Root logins stay as they are unless you choose otherwise, and each choice is refused while the platform itself signs in that way, so switch the server’s credential to a key first.
- 5
Dry run, then run
Dry run shows the firewall it found, the ports it would allow and anything it would block. If a check fails during the real run, every change is put back before the step ends, and a run that is cut off is undone by the server itself within five minutes.
- 6
Check firewalls outside the server
Cloud security groups and provider firewalls are not changed, so open or close ports there separately. Ports that Docker publishes stay reachable whatever the host firewall allows.