Skip to content
Hardened Ubuntu 26.04 LTS Secure Server product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· soonComing soon on Microsoft Azure
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

Hardened Ubuntu 26.04 LTS Secure Server

Ubuntu 26.04.1 LTS with a security baseline already applied and tested: the firewall is closed except for rate-limited SSH, fail2ban bans brute-force sources, SSH is key-only with root login refused, and security updates install themselves. auditd watches accounts, sudo rules and SSH settings, AIDE checks file integrity every day, and a Lynis audit runs on first boot so you start with a written report of where the server stands.

Version
v26.04
Operating system
Ubuntu 26.04 LTS
Architecture
x86_64
Support
Email support

What's installed

Every package and version on the image. Nothing else is installed.

  • Ubuntu 26.04.1 LTS (kernel 7.0.0-1017-aws)
  • UFW 0.36.2
  • fail2ban 1.1.0
  • auditd 4.1.2
  • AppArmor 5.0.2
  • AIDE 0.19.2
  • Lynis 3.1.6
  • Amazon SSM Agent 3.3.4793.0
  • Amazon CloudWatch Agent 1.300074

LicensingOpen source (Ubuntu and GPL-licensed security tools), no licence key required

Deploy anywhere

Hardened Ubuntu 26.04 LTS Secure Server on AWS.

Google Cloud is next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS

    Amazon Web Services

    AMI · v26.04

    Coming soon
    AWS AMI ID
    ami-0f18d3dfdeee5d692
    Released
    Root volume
    gp3 · 30 GiB
    Instance types
    • t3a.medium
    • t3.medium
    • t3a.large
    • m6a.large
    Regions34 regions· show all
    • us-east-1
    • af-south-1
    • ap-east-1
    • ap-east-2
    • ap-northeast-1
    • ap-northeast-2
    • ap-northeast-3
    • ap-south-1
    • ap-south-2
    • ap-southeast-1
    • ap-southeast-2
    • ap-southeast-3
    • ap-southeast-4
    • ap-southeast-5
    • ap-southeast-6
    • ap-southeast-7
    • ca-central-1
    • ca-west-1
    • eu-central-1
    • eu-central-2
    • eu-north-1
    • eu-south-1
    • eu-south-2
    • eu-west-1
    • eu-west-2
    • eu-west-3
    • il-central-1
    • me-central-1
    • me-south-1
    • mx-central-1
    • sa-east-1
    • us-east-2
    • us-west-1
    • us-west-2
    AWS launch steps

Getting started

From launch to signed in, step by step.

  1. Subscribe on AWS Marketplace and launch in your region with TCP 22 open, ideally only from your own IP address.

  2. SSH as ubuntu with your key pair. Password and root logins are refused.

  3. After three to five minutes, read the first-boot security report with sudo cat /var/lib/provencloud/reports/lynis-security-report.txt.summary.

  4. Run sudo provencloud-security-status for the firewall, fail2ban, SSH and AIDE status at a glance.

  5. The firewall blocks every other inbound port. Open one for your application with sudo ufw allow <port>/tcp and add it to your security group.

  6. For Systems Manager and CloudWatch Logs, attach an instance profile with AmazonSSMManagedInstanceCore and CloudWatchAgentServerPolicy, then run sudo systemctl enable --now amazon-cloudwatch-agent.

Security posture

What this image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 26.04 LTS image with every current security update applied, rebooted onto the newest kernel with the old kernel removed.

  • UFW denies all inbound traffic by default and rate-limits SSH; fail2ban's sshd jail bans an address for an hour after four failed attempts in ten minutes.

  • SSH accepts public keys only: password, keyboard-interactive and root logins are disabled, with three authentication attempts and a 30-second login window.

  • Unattended security upgrades are enabled. auditd rules record changes to passwd, shadow, group, gshadow, sudoers and the SSH configuration, and AppArmor is enabled.

  • AIDE's integrity database is generated at the end of the build and checked daily by a systemd timer, logging to /var/log/provencloud/aide.log.

  • A Lynis audit runs once on first boot and writes its report to /var/lib/provencloud/reports (hardening index 69 with no warnings on our test launch).

  • Amazon SSM Agent is installed and running; the CloudWatch Agent ships configured for auth, audit, fail2ban, AIDE and Lynis logs but stays off until you attach a role.

  • No password or credential ships in the image; build-time SSH keys, host keys, shell history, cloud-init state and logs were removed before imaging, and host keys are regenerated per instance.