Server Hardening Guide for Ubuntu

Server Hardening Guide for Ubuntu: Shared Memory, Network, Sysctl, Swap & More

by

Hardening an Ubuntu server involves a series of configuration adjustments to enhance security and performance. The first step secures shared memory by setting stricter mount options on /run/shm, preventing unauthorized code execution. Next, network-level hardening is done using sysctl by enabling protections against IP spoofing, SYN attacks, and disabling unnecessary routing and packet forwarding, effectively locking down the system’s exposure to network threats. Setting the correct timezone ensures consistent logging and system behavior, especially in environments where accurate timestamps are critical.

System performance tuning follows, using both manual sysctl tweaks and the tuned utility. Sysctl allows for deeper kernel-level optimization like increasing buffer sizes and file handle limits, while tuned applies system-wide profiles like throughput-performance to improve efficiency. Adding the noatime flag in the file system mount options reduces disk I/O overhead by preventing unnecessary metadata writes. Lastly, managing swap space with a dedicated file, along with tuning swappiness and vfs_cache_pressure, helps balance memory usage and prolongs hardware lifespan by reducing excessive swapping and memory strain.

🛡️ 1. Harden Shared Memory (/run/shm)

Backup and edit /etc/fstab

sudo cp /etc/fstab /etc/fstab.bak
sudo vi /etc/fstab

Add one of these lines at the bottom:

none /run/shm tmpfs defaults,ro 0 0
# If read-only causes issues, use this instead:
# none /run/shm tmpfs rw,noexec,nosuid,nodev 0 0

ro = read-only

noexec, nosuid, nodev = disable execution, SUID, and device files

Reboot to apply changes:

sudo reboot

Verify the mount:

mount | grep /run/shm

Look for:

none on /run/shm type tmpfs (ro,relatime)

or the alternative options if used.

🌐 2. Harden the Network Layer with Sysctl

View all kernel parameters:

sudo sysctl -a

Backup and edit sysctl.conf:

cd /etc
sudo cp sysctl.conf sysctl.conf.bak
sudo nano /etc/sysctl.conf

Add or uncomment these security-related settings:

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Disable routing (server only)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Do not accept source routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

Apply the changes:

sudo sysctl -p

⏰ 3. Manage Timezone

Show current timezone:

sudo timedatectl

List available timezones:

sudo timedatectl list-timezones

Search for a city:

sudo timedatectl list-timezones | grep city

Set timezone example:

sudo timedatectl set-timezone Africa/Johannesburg
sudo timedatectl set-timezone Asia/Jakarta

⚙️ 4. More Sysctl Tweaks for Performance

Edit /etc/sysctl.conf and add:

# Increase ports range
net.ipv4.ip_local_port_range = 1024 65535

# File handles and core dumps
fs.file-max = 2097152
fs.suid_dumpable = 0

# Connection backlog
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 262144

# Memory buffers
net.core.optmem_max = 25165824

# Send/receive buffers
net.core.rmem_default = 31457280
net.core.rmem_max = 67108864
net.core.wmem_default = 31457280
net.core.wmem_max = 67108864

Apply with:

sudo sysctl -p

🔧 5. Install and Use Tuned for System Tuning

Install Tuned:

sudo apt update
sudo apt install tuned

List profiles:

sudo tuned-adm list

Show active profile:

sudo tuned-adm active

Set profile to throughput-performance:

sudo tuned-adm profile throughput-performance

📂 6. Optimize File Access Times

Check current mount options:

cat /proc/mounts | grep /dev/vda1

Edit /etc/fstab to add noatime for your root partition:

sudo nano /etc/fstab

Find the root partition line and add noatime:

UUID=xxx-xxx-xxx / ext4 errors=remount-ro,noatime 0 1

Reboot:

sudo reboot

Confirm the noatime flag:

cat /proc/mounts | grep /dev/vda1

You should see rw,noatime in the options.

🔄 7. Manage Swap Space

Create a 2GB swap file:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

Verify swap:

sudo nano /etc/fstab

Make swap permanent:

sudo nano /etc/fstab

Add:

/swapfile swap swap defaults 0 0

Adjust Swappiness and Cache Pressure

Add to /etc/sysctl.conf:

vm.swappiness = 5
vm.vfs_cache_pressure = 50

Apply:

sudo sysctl -p

❌ Remove Swap File (if needed)

sudo swapoff -v /swapfile
sudo nano /etc/fstab
# Remove the swap entry line
sudo rm /swapfile
sudo reboot

📂 Increase Open File Limit on Ubuntu

To prevent errors from too many open files (especially for servers under heavy load), it’s important to raise the default open file limit in Ubuntu. Here’s how to do it:

🔧 Step 1: Edit the Limits Configuration

cd /etc/security/
sudo cp limits.conf limits.conf.bak
sudo nano limits.conf

Add the following lines at the end:

*       soft    nofile      999999
*       hard    nofile      999999
root    soft    nofile      999999
root    hard    nofile      999999

This sets both soft and hard limits for all users (and specifically for root) to 999999 open files.

🔐 Step 2: Enable PAM Support

To ensure these limits are applied during login sessions, update the PAM (Pluggable Authentication Module) configs:

sudo bash -c 'echo session required pam_limits.so >> /etc/pam.d/common-session'
sudo bash -c 'echo session required pam_limits.so >> /etc/pam.d/common-session-noninteractive'

🔁 Step 3: Reboot and Verify

Reboot your server:

sudo reboot

After reboot, verify the limits:

ulimit -Hn   # Hard limit
ulimit -Sn   # Soft limit

You should see 999999 as the new limit for both.

Server Hardening Guide for Ubuntu
Server Hardening Guide for Ubuntu