Chapter 6: Security Hardening

Updated

October 31, 2026

Chapter 6: Security Hardening

In contemporary threat environments, perimeter firewalls are insufficient. Security must be architectural, hardware-rooted, and enforced at every level of the operating system.

Ubuntu 26.04 LTS establishes a comprehensive defense-in-depth security model: from TPM 2.0-backed hardware full-disk encryption that prevents offline physical tampering, through AppArmor 4 mandatory access control, modern nftables packet filtering, and OpenSSH 10.2 post-quantum key exchange, to automated CIS Level 2 compliance profiles.

This chapter details the techniques and configurations required to harden an Ubuntu 26.04 workstation or server against sophisticated adversaries.

Ubuntu’s Security Model Overview

The Ubuntu security architecture operates across five defensive rings:

┌────────────────────────────────────────────────────────────────────────┐
│                   UBUNTU 26.04 SECURITY DEFENSE-IN-DEPTH               │
│                                                                        │
│   Ring 0: Hardware Root-of-Trust (UEFI Secure Boot + TPM 2.0 PCRs)     │
│   Ring 1: Kernel Hardening (Lockdown, KASLR, IBT, SMEP/SMAP)          │
│   Ring 2: Mandatory Access Control (AppArmor 4 / Landlock)             │
│   Ring 3: Network Isolation (nftables / UFW / WireGuard / IPsec)       │
│   Ring 4: Memory-Safe Userspace (sudo-rs, uutils, Seccomp Sandboxes)   │
└────────────────────────────────────────────────────────────────────────┘

TPM-Backed Full-Disk Encryption (TPM/FDE)

Traditional LUKS full-disk encryption requires human intervention at boot or complex key servers. Ubuntu 26.04 LTS natively integrates systemd-cryptenroll with hardware TPM 2.0 security chips:

┌────────────────────────────────────────────────────────────────────────┐
│                   TPM 2.0 AUTOMATIC UNSEALING FLOW                     │
│                                                                        │
│   1. Machine Powers On ──► UEFI Firmware Initializes                   │
│   2. Firmware measures BIOS, Option ROMs, and Secure Boot state into:  │
│      ├─ PCR 0 (Core System Firmware)                                   │
│      ├─ PCR 2 (Option ROMs / Device Firmware)                          │
│      └─ PCR 7 (Secure Boot Policy & Machine Keys)                      │
│   3. Bootloader (systemd-boot/GRUB) hashes kernel & UKI into PCR 11    │
│   4. systemd-cryptsetup queries TPM 2.0:                               │
│      "Are PCR 0, 2, 7, and 11 unaltered?"                              │
│      ├── YES: TPM releases unsealed LUKS master key ──► Root mounts!   │
│      └── NO:  Tampering detected! TPM locks; prompts for Recovery Key! │
└────────────────────────────────────────────────────────────────────────┘

Enrolling TPM 2.0 to an Existing LUKS Volume

# Identify LUKS2 partition (e.g., /dev/nvme0n1p3)
sudo blkid -t TYPE=crypto_LUKS

# Enroll TPM 2.0 bound to PCRs 0 (firmware), 2 (drivers), and 7 (Secure Boot)
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7 /dev/nvme0n1p3

# View active keyslots on partition
sudo cryptsetup luksDump /dev/nvme0n1p3 | grep -A 5 "systemd-tpm2"

If firmware settings or kernel binaries are modified without authorization, the TPM chip refuses to decrypt the disk, protecting customer data from offline extraction.

AppArmor Mandatory Access Control

Ubuntu enforces AppArmor 4 by default. Unlike Discretionary Access Control (DAC) where a process runs with the full permissions of its user, AppArmor restricts what a program can do regardless of UID:

# Check overall AppArmor status and loaded profiles
sudo aa-status
# 68 profiles are in enforce mode.
# 0 profiles are in complain mode.
# 12 processes are in enforce mode.

Writing a Custom AppArmor Profile

Create a profile under /etc/apparmor.d/usr.bin.myapp:

#include <tunables/global>

profile myapp /usr/bin/myapp {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # Allow read access to configuration
  /etc/myapp/** r,

  # Allow read/write access to logging and data directories
  /var/log/myapp/** rw,
  /var/lib/myapp/** rw,

  # Deny all access to sensitive files explicitly
  deny /home/** rwklx,
  deny /root/** rwklx,
  deny /etc/shadow r,

  # Restrict network operations
  network inet tcp,
}

Load the profile:

sudo apparmor_parser -r /etc/apparmor.d/usr.bin.myapp

Firewall Configuration: nftables and UFW

The Linux kernel packet filtering engine is nftables. Ubuntu provides UFW (Uncomplicated Firewall) as a management interface.

Hardening with UFW

# Set default traffic policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw default deny routed

# Allow SSH with rate limiting (mitigates brute-force attacks)
sudo ufw limit proto tcp to any port 22

# Allow HTTPS traffic
sudo ufw allow 443/tcp

# Enable firewall logging
sudo ufw logging medium

# Enable UFW and verify active rules
sudo ufw enable
sudo ufw status verbose

Raw nftables Inspection

Inspect the generated kernel nftables ruleset directly:

sudo nft list ruleset

SSH Hardening with OpenSSH 10.2

Ubuntu 26.04 LTS includes OpenSSH 10.2, featuring post-quantum hybrid key exchange (sntrup761x25519-sha512@openssh.com) by default to resist future quantum computing decryption.

Harden /etc/ssh/sshd_config.d/99-hardened.conf:

# Enforce modern cryptographic algorithms only
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com

# Disable legacy root logins and password authentication
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# Session limits and timeouts
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 5

# Restrict authorized users
AllowGroups sudo sshusers

Validate syntax and restart daemon:

sudo sshd -t
sudo systemctl restart ssh.service

Security Updates and Canonical Livepatch

Ubuntu Pro includes Canonical Livepatch, which applies high and critical CVE kernel security patches in memory without requiring a server reboot:

# Verify Livepatch client status
canonical-livepatch status

# Check applied kernel live patches
canonical-livepatch status --verbose
Client version: 10.8.2
Architecture:   x86_64
CPU model:      AMD EPYC 9654
Patch status:   Applied
Kernel release: 6.14.0-15-generic
Livepatch ID:   lp-2026-10-28-01
Patched CVEs:   CVE-2026-2184, CVE-2026-3019

Enterprise Compliance: CIS Benchmarks, HIPAA, and SOC 2

Ubuntu 26.04 LTS includes automated compliance remediation tools via Ubuntu Pro:

# Install Ubuntu Security Guide (USG)
sudo apt install -y usg

# Audit system against CIS Ubuntu 26.04 Level 2 Server Benchmark
sudo usg audit cis-level2-server

# View compliance report
firefox /var/lib/usg/usg-report-*.html

# Automatically remediate non-compliant configurations
sudo usg fix cis-level2-server

USG automatically enforces: - Password complexity and PAM lockout policies. - Auditd rules for privileged commands and file modifications. - Disabling obsolete network protocols (DCCP, SCTP, RDS). - Restricting core dumps and kernel dmesg access.

Chapter Summary

  • Ubuntu 26.04 enforces defense-in-depth across hardware, kernel, and userspace layers.
  • TPM 2.0 unseals LUKS disk encryption keys automatically only when Secure Boot PCRs remain untampered.
  • AppArmor 4 restricts processes to least-privilege profiles regardless of root execution.
  • UFW and nftables drop unauthorized inbound traffic with built-in connection rate limiting.
  • OpenSSH 10.2 secures remote administration with quantum-resistant key exchange algorithms.
  • Canonical Livepatch and USG ensure continuous compliance across CIS, HIPAA, and SOC 2 baselines.