Flexus L on Ubuntu 24.04: Build and Harden from Scratch

Why this order matters

A new cloud server is reachable from the internet the moment it is created. I therefore do the hardening before I install any application: first lock down who can log in, then shrink what the network exposes, then add brute-force protection and basic kernel tuning.

1. Key-only SSH login

Generate a key pair on my own computer, then copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@<server-ip>

Test that key login works in a new terminal window before changing anything else. Only then edit /etc/ssh/sshd_config:

PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin prohibit-password

Reload SSH and confirm a password login is refused. Keeping one working session open while I test the new settings avoids locking myself out.

2. Security group: least privilege

In the Huawei Cloud console I keep the security group as small as I can:

• SSH (22): only from my own IP, not from 0.0.0.0/0.
• HTTP (80) and HTTPS (443): only when the server actually serves a website.
• Everything else: closed by default.

The rule is simple: if a port is not needed this week, it stays closed.

3. fail2ban against brute force

Even with password login off, repeated login attempts fill the logs. I install and enable fail2ban:

apt update && apt install -y fail2ban
systemctl enable --now fail2ban
fail2ban-client status sshd

It watches the SSH log and temporarily bans addresses that fail repeatedly. I check its status once after setup instead of assuming it works.

4. Swap for a small server

A small instance can run out of memory during updates. A modest swap file gives it breathing room:

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

I add it to /etc/fstab so it survives a reboot, and verify with free -h. Swap is a safety net, not a replacement for enough memory.

5. BBR congestion control

For a server that serves content over the internet, I enable BBR:

# /etc/sysctl.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

Apply with sysctl -p and verify with sysctl net.ipv4.tcp_congestion_control. I do not promise a speed number here; the point is a modern, widely used congestion algorithm instead of the default.

Final checklist

• [ ] Key login works, password login is refused
• [ ] Security group exposes only the ports in use
• [ ] fail2ban is running for sshd
• [ ] Swap is present after a reboot
• [ ] BBR is the active congestion control

Done in this order, a fresh Flexus L server on Ubuntu 24.04 is usable without leaving the usual defaults exposed.