Hardening Ubuntu for a Homelab

Introduction

This guide provides step-by-step instructions for hardening Ubuntu systems in homelab environments, focusing on security best practices and system hardening techniques.

Prerequisites

• Ubuntu 20.04 LTS or later
• Root or sudo access
• Basic command line knowledge

Step 1: System Updates

First, ensure your system is up to date:

sudo apt update && sudo apt upgrade -y

Step 2: Firewall Configuration

Configure UFW (Uncomplicated Firewall):

# Enable UFW
sudo ufw enable

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (adjust port as needed)
sudo ufw allow ssh

Step 3: SSH Hardening

Edit the SSH configuration:

sudo nano /etc/ssh/sshd_config

Key settings to modify:

# Disable root login
PermitRootLogin no

# Disable password authentication
PasswordAuthentication no

# Change default port
Port 2222

# Limit users
AllowUsers yourusername

Step 4: System Hardening

Disable Unnecessary Services

# Check running services
sudo systemctl list-units --type=service --state=running

# Disable unnecessary services
sudo systemctl disable bluetooth
sudo systemctl disable cups
sudo systemctl disable avahi-daemon

Configure Automatic Security Updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Step 5: User Account Security

Create a non-root user

# Create user
sudo adduser homelab

# Add to sudo group
sudo usermod -aG sudo homelab

# Switch to new user
su - homelab

Configure sudo

sudo visudo

Add the following line:

homelab ALL=(ALL) NOPASSWD:ALL

Conclusion

This hardening process significantly improves the security posture of your Ubuntu homelab system. Remember to:

• Regularly update packages
• Monitor system logs
• Use strong authentication methods
• Keep backups of important configurations

Additional Resources

• Ubuntu Security Documentation
• CIS Ubuntu Benchmark
• NIST Cybersecurity Framework