Abdul Mannan Qayyum
← Work

Ubuntu Security Audit

June 2026

5 findings (1 critical, 2 high, 2 medium), all remediated on a single personal Ubuntu server.

Scope and limitations

This was a single-host audit against one personal Ubuntu server — not a full network penetration test, and not a client engagement. It covers what was checked on that one host: firewall state, SSH hardening, package currency, and unnecessary exposed services. Nothing here implies broader network scope, lateral-movement testing, or application-layer testing beyond what's shown below.

Exhibit A
criticalE1Executed or directly observed.Firewall Disabled

UFW was completely inactive — no rules controlled inbound connections, so any service on the host was reachable from the internet.

Before

Terminal output of ss -tulnp showing all listening ports unfiltered, with ufw status reported as inactive

ufw status: inactive; ss -tulnp showing all listening ports unfiltered

After

Terminal output of ufw allow OpenSSH and ufw enable, with the firewall reported active and enabled on startup

UFW enabled, OpenSSH explicitly allowed, default-deny on everything else

Exhibit B
highE1Executed or directly observed.SSH — No Login Attempt Limit

sshd_config had no cap on failed authentication attempts, leaving the host open to unthrottled brute-force login attempts.

Before

sshd_config open in a text editor, showing MaxAuthTries and PermitRootLogin left at commented-out default values

sshd_config: MaxAuthTries and related hardening directives left at commented defaults

After

Terminal output confirming fail2ban is installed and active

Fail2ban installed and active — automatically bans IPs after repeated failed attempts

Exhibit C
highE1Executed or directly observed.SSH — Root Login Not Blocked

PermitRootLogin was not explicitly disabled, so a compromised root password would have granted an attacker immediate full control.

Before

sshd_config open in a text editor, showing MaxAuthTries and PermitRootLogin left at commented-out default values

sshd_config: PermitRootLogin left at commented default

After

sshd_config showing PermitRootLogin explicitly set to no

PermitRootLogin set to no, SSH service restarted to apply

Exhibit D
mediumE1Executed or directly observed.Outdated System & Packages

20+ packages had pending security updates, including the Linux kernel — known, unpatched vulnerabilities sitting exposed.

Before

Terminal output of apt list --upgradable showing over 20 pending package updates, including the Linux kernel

apt list --upgradable: 20+ packages pending, including linux-image/linux-generic

After

Terminal output of apt upgrade showing 19 packages upgraded, including a kernel version update

19 packages upgraded, kernel updated 6.8.0-111 -> 6.8.0-124, 12 LTS security updates applied

Exhibit E
mediumE1Executed or directly observed.Unnecessary Exposed Service (Apache)

Apache was running and internet-exposed on port 80 despite not being required for the server's purpose — unnecessary attack surface.

Before

Terminal output of ss -tulnp showing all listening ports unfiltered, with ufw status reported as inactive

ss -tulnp showing apache2 bound and listening on port 80

After

Terminal output of apt remove apache2 showing the package removed and UFW firewall rules reloaded

apache2 fully removed, UFW rules automatically reloaded

Summary

1 critical, 2 high, 2 medium — all remediated during the audit. Zero critical or high findings remain open.