Mastodon Host Hardening: SSH and Firewall Security Profile

By 4FreeForums Editors · Published October 30, 2026 · Sources linked below

Deploying a decentralized community node requires establishing strict baseline defenses at the operating system layer before installing application software. When preparing an environment for hosting, locking down remote management interfaces and enforcing a default-deny packet filtering strategy minimizes attack vectors from the moment the server comes online. The official Mastodon documentation on preparing your machine specifies baseline security controls for hosts running Ubuntu 22.04. This profile details the essential parameters for securing the SSH daemon, configuring automated intrusion defenses, and deploying persistent filtering across both IPv4 and IPv6.

SSH Daemon Hardening Parameters

Securing remote access begins with eliminating password-based authentication across all administrative logins. Before modifying access parameters, administrators must verify that public key authentication is operational to avoid permanent lockout. Many hosting providers support uploading a public key directly, which enables automated key-based root access upon instance creation. For overall server administration hygiene, coordinating these access methods aligns with broader Forum Admin Security: 10 Steps to Protect Your Forum From Takeovers.

Once key access is verified, update the package indexes and apply pending updates by executing:

apt update && apt upgrade -y

To disable password authentication, open /etc/ssh/sshd_config, locate the PasswordAuthentication directive, ensure it is uncommented, and set its value to no. Apply this hardening measure by restarting the SSH service:

systemctl restart ssh.service

Fail2ban Intrusion Defense Profile

Automated scanning engines frequently target remote management ports. Deploying fail2ban monitors authentication logs and blocks repeated failed connection attempts. Install the utility via:

apt install fail2ban

Configure the jail settings by editing /etc/fail2ban/jail.local with the following parameters:

[DEFAULT]
destemail = your@email.here
sendername = Fail2Ban

[sshd]
enabled = true
port = 22
mode = aggressive

After saving the jail file, activate the configuration with systemctl restart fail2ban. If the service fails to start with the error message “Failed during configuration: Have not found any log file for sshd jail”, resolve the issue by appending backend=systemd to the [sshd] section. In some system environments, installing the python3-systemd package is also required to allow proper log parsing under systemd.

Persistent IPv4 Firewall Architecture

A resilient host requires filtering inbound traffic down to the minimal ports necessary for federated web communications. For step-by-step application deployment that follows host hardening, refer to Installing Mastodon from Source on Ubuntu: Step-by-Step Guide.

Network rules are made persistent using the iptables-persistent package. When running apt install -y iptables-persistent, the installer prompts whether to save existing rules; decline this prompt to configure custom tables manually. The rules are defined in /etc/iptables/rules.v4:

*filter
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# (optional) Allow HTTP/3 connections from anywhere.
-A INPUT -p udp --dport 443 -j ACCEPT
# Allow SSH connections
# The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# Allow destination unreachable messages, especially code 4 (fragmentation required) is required or PMTUD breaks
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT

To apply these rules immediately without restarting the host, load them via:

iptables-restore < /etc/iptables/rules.v4

Persistent IPv6 Filtering Rules

Servers reachable over IPv6 require an equivalent ruleset to avoid leaving network services unprotected on modern addressing schemes. Populate /etc/iptables/rules.v6 with the following filter directives:

*filter
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d ::1/128 -j REJECT
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# (optional) Allow HTTP/3 connections from anywhere.
-A INPUT -p udp --dport 443 -j ACCEPT
# Allow SSH connections
# The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmpv6 -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT

Activate the IPv6 firewall rules immediately by loading them through the restore utility:

ip6tables-restore < /etc/iptables/rules.v6

Hardening Parameters at a Glance

SSH Authentication: Set PasswordAuthentication no in /etc/ssh/sshd_config and reload ssh.service.
Intrusion Mitigation: Enable fail2ban on port 22 using mode = aggressive in /etc/fail2ban/jail.local.
Web Protocols: Permit incoming traffic on TCP port 80 and TCP port 443; optionally permit UDP port 443 for HTTP/3 traffic.
Remote Access: Open incoming TCP connections for new states on port 22 (matching the configured SSH daemon port).
ICMP Diagnostics: Permit ICMP type 8 for ping requests, along with ICMP type 3 destination unreachable messages (code 4 fragmentation required) to prevent breaking Path MTU Discovery (PMTUD). For IPv6, permit icmpv6.
Audit Logging: Log denied packets up to a rate limit of 5 per minute with log level 7 before rejecting unmatched input and forward traffic.

Detailed technical requirements and setup procedures are maintained in the Mastodon documentation (updated June 25, 2025).

Sources

Preparing your machine - Mastodon documentation

Published October 30, 2026. No affiliate links on this page. Facts come from the sources linked above; check them for updates.