Ubuntu Serverセキュリティ：実用的なLinux強化チェックリスト

# Add a new administrative user
adduser deployer

# Grant administrative sudo privileges
usermod -aG sudo deployer

# Copy your local SSH public key to the new user
mkdir -p /home/deployer/.ssh
cp /root/.ssh/authorized_keys /home/deployer/.ssh/
chown -R deployer:deployer /home/deployer/.ssh
chmod 700 /home/deployer/.ssh
chmod 600 /home/deployer/.ssh/authorized_keys

# /etc/ssh/sshd_config.d/99-hardened.conf

# Completely disable root login over SSH
PermitRootLogin no

# Disable password authentication (Keys required)
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

# Restrict authentication attempts before dropping connection
MaxAuthTries 3
MaxSessions 2

# Modern cryptographic ciphers and key exchanges (Disables legacy RSA/SHA1)
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com

# Disable unused forwarding capabilities to prevent proxy tunneling
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no

# Test sshd configuration syntax
sudo sshd -t

# Restart SSH service
sudo systemctl restart ssh

# Reset UFW to default clean state
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH with rate limiting (Blocks IPs making >6 connections in 30s)
sudo ufw limit 22/tcp comment 'SSH Rate Limited'

# Open standard web traffic ports
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Enable the firewall
sudo ufw enable

# Verify active status
sudo ufw status verbose

# Restrict PostgreSQL to internal VPN or backend IP
sudo ufw allow from 10.8.0.5 to any port 5432 proto tcp comment 'Postgres VPN Only'

# Install Fail2ban
sudo apt-get update && sudo apt-get install -y fail2ban

# Create local configuration override
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[DEFAULT]
# Ban IP for 1 hour after 5 failures in 10 minutes
bantime = 1h
findtime = 10m
maxretry = 5
banaction = ufw

[sshd]
enabled = true
port = 22
mode = aggressive

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

sudo apt-get install -y unattended-upgrades update-notifier-common
sudo dpkg-reconfigure --priority=low unattended-upgrades

// Automatically install critical security updates
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

// Automatically remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Automatically reboot if a kernel update requires it (at 03:00 AM)
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

# /etc/sysctl.d/99-security.conf

# Ignore ICMP echo broadcasts (Prevents Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Protect against SYN flood denial of service
net.ipv4.tcp_syncookies = 1

# Disable ICMP redirect acceptance (Prevents routing table poisoning)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Enable IP spoofing protection (Reverse Path Filtering)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable source routing packet acceptance
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Restrict dmesg kernel log access to root
kernel.dmesg_restrict = 1

sudo sysctl --system