Security Hardening - Part 3: Timezone & Fail2ban
Step 1: Set Timezone
Setting the correct timezone helps with logs and scheduled tasks.
Check Current Timezone
timedatectl
Set to Your Timezone (Belgium)
timedatectl set-timezone Europe/Brussels
Verify
timedatectl
Should show:
Time zone: Europe/Brussels (CET, +0100)
Step 2: Install Fail2ban
Fail2ban monitors logs and bans IPs that show malicious signs (repeated failed logins, etc.).
Install Fail2ban
apt install fail2ban -y
Create Local Configuration
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local
Find and Modify These Settings
Search for [sshd] section (use Ctrl+W in nano):
[sshd]
enabled = true
port = ssh
# If you changed SSH port, update it here:
# port = 2222
logpath = %(sshd_log)s
maxretry = 3
bantime = 3600
findtime = 600
What this means:
maxretry = 3: Ban after 3 failed attemptsfindtime = 600: Within 10 minutesbantime = 3600: Ban for 1 hour (3600 seconds)
Save and Exit
Ctrl+X, Y, Enter
Enable and Start Fail2ban
systemctl enable fail2ban
systemctl start fail2ban
Check Fail2ban Status
systemctl status fail2ban
Should show active (running).
Check Banned IPs (if any)
fail2ban-client status sshd
Step 3: Create Non-Root User (Optional but Recommended)
It’s good practice to not use root for daily tasks.
Create New User
adduser myNewUser
Follow prompts (set password, can skip other fields by pressing Enter).
Add to Sudo Group
usermod -aG sudo myNewUser
Copy SSH Keys to New User
mkdir -p /home/myNewUser/.ssh
cp /root/.ssh/authorized_keys /home/myNewUser/.ssh/
chown -R myUser:myNewUser /home/myNewUser/.ssh
chmod 700 /home/myNewUser/.ssh
chmod 600 /home/myNewUser/.ssh/authorized_keys
Test New User Login
From a new terminal:
ssh myNewUser@YOUR_SERVER_IP
Use Sudo for Admin Commands
sudo apt update
Optional: Disable Root Login Entirely
If you want to force everyone to use the non-root user:
nano /etc/ssh/sshd_config
Change:
PermitRootLogin prohibit-password
To:
PermitRootLogin no
Then restart SSH:
systemctl restart ssh
Note: Only do this after confirming the new user works!