1. SSH Service Security Settings
The SSH service allows the root user to log in by default, and since the root user already knows the user name and can log in to the server with administrative privileges once the password is known, we will deny this setting.
1.1 Creating a General User
If you created a regular user during the Ubuntu 26.04 installation, you do not need to follow these steps.
If you have already created a user at the time of OS installation, this procedure is not necessary. If you have already created a user during OS installation, this procedure is not necessary.
If you have already created a user during OS installation, this procedure is not necessary. The "-m" option creates a home directory and the "-p" option specifies the password.
For example, to set "ubuntuuser" as the user account name and "123456" as the password, execute as follows
# useradd -m -p 123456 ubuntuuser
1.2 SSH service configuration file changes
To change the SSH service settings, modify the configuration file, which is located in "/etc/ssh/sshd_config".
This time, we will change the default SSH port 22 to 2244.
# vi /etc/ssh/sshd_config
Line 36 : Added ssh connection port 2244
#port 22
Port 2244
Line 38 : Uncommented
ListenAddress 0.0.0.0
Line 56 : Uncommented(prohibit-password disables password authentication for root)
PermitRootLogin prohibit-password
# vi /lib/systemd/system/ssh.socket
Change the next parameter on lines 7-8 to the selected port (e.g., 2244).
ListenStream=0.0.0.0:2244
ListenStream=[::]:2244
Reload the daemon
# systemctl daemon-reload
Restart SSH service
# systemctl restart ssh
If you try to connect via SSH again now, it won't work. So, allow the modified SSH port 2244 in the next firewall.
2. Firewall Settings
In Ubuntu, it is often configured to configure a firewall using software called "ufw", so configure the firewall using ufw.
ufw is installed at the time of the introduction of the OS. We will introduce the procedure for performing minimal filter settings after installation.
2.1 Check ufw package
Check the installed UFW package
# dpkg -l | grep ufw
ii ufw 0.36.2-10 all program for managing a Netfilter firewall
Installed "ufw packages" are displayed.
Check the operation status of ufw
# systemctl status ufw
● ufw.service - Uncomplicated firewall
Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled; preset: enabled)
Active: active (exited) since Fri 2026-10-16 09:45:43 JST; 41min ago
Invocation: be44f9ac3a7c42e79cd2e2eab2d51259
Docs: man:ufw(8)
Main PID: 926 (code=exited, status=0/SUCCESS)
Mem peak: 2.3M
CPU: 5ms
Oct 16 09:45:43 lepard systemd[1]: Starting ufw.service - Uncomplicated firewall...
Oct 16 09:45:43 lepard systemd[1]: Finished ufw.service - Uncomplicated firewall.
you can confirm that the ufw service is running by seeing "Active: inactive (exited)".
Enable ufw.
# systemctl enable ufw
# ufw enable
2.2 Basic firewall rule configuration
When ufw is enabled, default firewall rules are applied. If you enable it as is, you may lose communication with the server, so set basic rules before enabling ufw.
2.2.1 Incoming packets Default rule settings
First, set the rules for incoming packets. The general rule is to deny all incoming packets except for specific communications. Execute "ufw default deny incoming" to basically deny all incoming packets.
# ufw default deny incoming
Default incoming policy changed to 'deny'
(be sure to update your rules accordingly)
2.2.2 Outgoing packets Default rule settings
The general rule is to allow all outgoing packets. Execute "ufw default allow outgoing" to basically allow outgoing packets.
# ufw default allow outgoing
Default outgoing policy changed to 'allow'
(be sure to update your rules accordingly)
2.3 Open SSH port
Allow SSH connections. The default SSH port is 22. Allow with the following command
# ufw allow ssh
# ufw reload
If you have set your own 2244 port
# ufw allow 2244/tcp
# ufw reload
2.4 Confirmation of ufw settings
Check the rules configured in the firewall after enabling." ufw status verbose".
# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
123/udp ALLOW IN Anywhere
22/tcp ALLOW IN Anywhere
2244/tcp ALLOW IN Anywhere
123/udp (v6) ALLOW IN Anywhere (v6)
22/tcp (v6) ALLOW IN Anywhere (v6)
2244/tcp (v6) ALLOW IN Anywhere (v6)
2.5 Limit packets coming into the server
If you want to "allow communication coming to port number ◯◯" in ufw settings, use the following command
# ufw allow [Port number]/tcp
If you want to "disallow communication coming to port number ◯◯", use the following command
# ufw deny [Port number]/tcp
① Opening of the web and other services
You can allow connections by specifying a port number, or you can specify an application.
You can see a list of applications with the following command.
# vi /etc/services
For example, to enable http and https for web services
# ufw allow http
Rule added
Rule added (v6)
# ufw allow https
Rule added
Rule added (v6)
# ufw reload
➁ Disable ipv6 ufw
# vi /etc/default/ufw
Line 7
IPV6=yes → IPV6=no #change
Restart the firewall after all work
# systemctl restart ufw