whoami
Hi, I’m a cybersecurity student passionate about Linux server security. In this post, I walk through three practical experiments I performed on a fresh Ubuntu 24.04 LTS server to measure the real-world impact of common hardening techniques using tools like Lynis, UFW, Google Authenticator, and Fail2ban.
Experiment time!
Experiment #1: Baseline vs Post-Hardening Security Audit with Lynis
Objective:
To evaluate the effectiveness of basic security hardening techniques on an Ubuntu 24.04 server by comparing system audit scores before and after applying security modifications.
Actions Taken:
- Performed a baseline audit using Lynis to assess the initial security posture.
- Installed and configured UFW to deny all incoming traffic by default, then explicitly allowed SSH.
- Enabled essential hardening tools such as Fail2ban and Google Authenticator for brute-force protection and MFA.
- Re-ran the Lynis audit after applying these controls to measure improvements.
Key Findings:
- The Lynis post-hardening score improved, indicating stronger overall security.
- Fewer warnings and suggestions were reported after firewall rules, SSH hardening, and authentication enhancements were applied.
- SSH access behaved as expected: blocked when UFW was restrictive, and allowed once proper rules were applied.
Experiment #2: MFA Impact on SSH Authentication with Google Authenticator
Objective:
To test how enabling Multi-Factor Authentication (MFA) using Google Authenticator affects SSH login security and workflow on an Ubuntu 24.04 server.
Actions Taken:
- Installed the Google Authenticator PAM module on the server.
- Configured the SSH service to require both a password and a time-based one-time password (TOTP) generated by the mobile app.
- Tested login with password only (denied access).
- Then tested login with both password and correct TOTP code (access granted).
Key Findings:
- SSH login was successfully restricted to users who provided both authentication factors.
- Password-only login attempts were blocked, demonstrating enhanced login security.
- The setup process introduced an additional security layer without significantly complicating user access.
Experiment #3: SSH Brute-Force Attack Simulation with and without Fail2ban
Objective:
To evaluate the effectiveness of Fail2ban in detecting and blocking brute-force SSH login attempts on an Ubuntu 24.04 server.
Actions Taken:
- Simulated repeated failed SSH login attempts from an external system using a tool such as Hydra.
- Monitored system behavior and logs (e.g.,
/var/log/fail2ban.log). - Observed that Fail2ban automatically banned the attacker IP after the defined number of failed login attempts.
- Disabled Fail2ban and repeated the test to observe the difference in system response.
Key Findings:
- With Fail2ban enabled, the server successfully detected and blocked the attacker’s IP after repeated failed attempts.
- Without Fail2ban, brute-force attempts were not stopped, allowing unlimited login trials.
- The banning action was logged, confirming automated protection in real-time.
Conclusion
These three straightforward experiments clearly demonstrate that even basic, freely available hardening tools can dramatically improve the security posture of an Ubuntu 24.04 server:
- Lynis provides an objective before-and-after measurement of overall hardening progress.
- Google Authenticator MFA stops attackers dead in their tracks even if passwords are leaked.
- Fail2ban automatically mitigates one of the most common real-world threats—brute-force attacks.
Together, UFW + Fail2ban + Google Authenticator form a solid foundational defense layer that every public-facing Linux server should have.
Final thoughts
Hardening doesn’t have to be complex or expensive. Spending just a couple of hours applying these controls and validating them with tools like Lynis and simulated attacks yields massive risk reduction. Start with these basics, measure the improvement, then layer on more advanced controls (CIS benchmarks, AppArmor, etc.) as needed.
Key Takeaways
- Always measure—don’t just assume your changes helped.
- MFA is non-negotiable for any internet-facing SSH service in 2025.
- Fail2ban is still one of the best “set-it-and-forget-it” protections available.
References
- Lynis – https://cisofy.com/lynis
- UFW Documentation – https://help.ubuntu.com/community/UFW
- Fail2ban Official Site – https://www.fail2ban.org
- Google Authenticator PAM Module – GitHub