Image retained from the original article.
Originally published 25 July 2023; rewritten and reviewed on 15 October 2026.
The most dangerous moment in a routine hardening task can be the instant a remote administrator enables a firewall or disables password sign-in. A setting intended to reduce risk can also remove the only working management route. My first concern would be the sequence of changes.
Verify access before restricting it
Identify the distribution, package sources, SSH configuration and actual administrative port. Keep a tested recovery route through the hosting console. When changing authentication, confirm key-based access in another session before closing the working one.
For an Ubuntu installation using UFW, inspect the rules first. Allow the management path actually in use before enabling a restrictive policy. An OpenSSH profile is not evidence that a customised SSH port has been allowed.
# Inspection only: verify tools exist on this distribution.
sudo ufw status verbose
sudo sshd -t
systemctl --failed
These commands check different parts of the system. They are not a complete hardening procedure, and the SSH daemon’s path or service name may differ.
Keep the application within its own permissions
Run services under appropriate non-root identities, restrict writable directories and remove unneeded listeners. Apply security updates through supported repositories and schedule required restarts. Review secrets and configuration separately from application code.
Logs and monitoring need an owner. Failed authentication, unexpected service changes and storage exhaustion deserve attention that survives the initial setup session.
Rehearse recovery
Back up the data and configuration needed to reconstruct the service, then test the restoration path. Check application behaviour after firewall, permission and service changes rather than making a long series of unverified edits.
A useful hardening record states what changed, why, how access was preserved and what was tested. That record is often what makes a secure configuration maintainable when someone else takes over.