What are the core concepts covered in Linux Networking, SSH Key Hardening & UFW Firewall?

Inspecting network addresses and routes with ip addr and ip route; Auditing listening network ports and TCP sockets with ss -tulpn; Hardening OpenSSH Server configuration (/etc/ssh/sshd_config); Configuring stateful packet filtering rules with UFW (Uncomplicated Firewall)

Intermediate 24 min readModule: Module 7: Linux Networking, SSH Hardening & UFW Firewalls

Linux Networking, SSH Key Hardening & UFW Firewall

Inspect network interfaces, socket statistics (ss), configure SSH public-key authentication, disable root password logins, and manage packet filtering with UFW.

What You Will Learn in This Lesson

Inspecting network addresses and routes with ip addr and ip route
Auditing listening network ports and TCP sockets with ss -tulpn
Hardening OpenSSH Server configuration (/etc/ssh/sshd_config)
Configuring stateful packet filtering rules with UFW (Uncomplicated Firewall)

Introduction & Core Concept

Linux networking is governed by the kernel's network stack and the Netfilter packet filtering subsystem. Securing an internet-facing Linux server requires restricting listening ports, enforcing cryptographic SSH key authentication, and configuring firewall rules to reject unauthorized traffic.

WHY DOES THIS MATTER IN THE REAL WORLD?

Public cloud servers are scanned thousands of times daily by automated botnets attempting SSH brute-force attacks. Hardening SSH and maintaining strict firewall rules is the first line of defense against network intrusion.

Syntax & Structure

bash

ss -tulpn
ufw default deny incoming
ufw allow 22/tcp
ufw enable
ssh-keygen -t ed25519

Securing Server Ports and Hardening SSH Configuration

bash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#!/usr/bin/env bash
# Server Network Inspection & UFW Firewall Hardening
 
echo "=== 1. Active Listening Network Sockets ==="
sudo ss -tulpn | grep LISTEN
 
echo -e "
=== 2. Configuring UFW Firewall Baseline ==="
# Default: Deny all inbound, allow all outbound
sudo ufw default deny incoming
sudo ufw default allow outgoing
 
# Allow essential web and administration ports
sudo ufw allow 22/tcp comment "SSH Administration"
sudo ufw allow 80/tcp comment "HTTP Web"
sudo ufw allow 443/tcp comment "HTTPS Secure Web"
 
# Enable Firewall
sudo ufw --force enable
sudo ufw status verbose
 
echo -e "
=== 3. Recommended OpenSSH Hardening Settings (/etc/ssh/sshd_config) ==="
cat << 'EOF'
# Key Hardening Directives:
# PasswordAuthentication no
# PermitRootLogin prohibit-password
# PubkeyAuthentication yes
# X11Forwarding no
# MaxAuthTries 3
EOF

Line-by-Line Technical Breakdown

1ED25519 Keys: Modern cryptography recommends `ssh-keygen -t ed25519` over older RSA keys because ED25519 provides faster signature verification, smaller key sizes (68 characters), and stronger resistance to side-channel attacks.

Try It Yourself (Interactive Editor)

Modify the code in real-time and click Run to test live browser output and console logs.

Intelligent Code Runner & Live Sandbox[BASH]

BASH SOURCE EDITOR

Interactive Live Code

>=== KWAS Production Deployment Pipeline ===

>Running set -euo pipefail checks: OK

>Containers healthy, 0 errors logged.

>Deployment completed successfully.

Common Mistakes & How to Avoid Them

#1: Enabling UFW firewall before allowing port 22/SSH, locking the administrator out of the server.

Always whitelist your SSH administration port BEFORE enabling the firewall on remote cloud servers.

Incorrect / Antipattern

sudo ufw default deny incoming
sudo ufw enable

Correct / Professional Solution

sudo ufw allow 22/tcp
sudo ufw enable

Industry Best Practices & Professional Standards

Use modern ED25519 SSH keys with a passphrase instead of traditional password logins.
Disable PasswordAuthentication and PermitRootLogin in /etc/ssh/sshd_config.
Regularly audit listening network ports using ss -tulpn to ensure no unauthorized processes are exposed.

Lesson Summary & Core Takeaways

Use `ss -tulpn` to identify all network services listening on open ports.
Enforce public-key authentication for SSH and disable root password logins.
Configure UFW to deny incoming traffic by default and whitelist only required ports.