Written with AI assistance; the role itself was built and lint-checked by the author's AI assistant, which works for a DevOps engineer.

Hardening a server is easy. Hardening it and still being able to log in afterwards is the part people get wrong. Most lockouts I have seen described come from a few causes: SSH password login turned off before a key was installed, a firewall enabled before the SSH rule existed, or an sshd config with a typo that stops the daemon from restarting.

This article walks through an Ansible approach for a fresh Ubuntu 24.04 VPS that avoids those three. Everything below is free to copy. The snippets are short adaptations of an Ansible role I wrote, so you can apply the ideas in your own playbook.

The order is the safety mechanism

The role's main.yml runs the parts in this order:

users → ufw → ssh → fail2ban → updates → sysctl → auditd → services → banner

Enter fullscreen mode

Exit fullscreen mode

The reasoning:

Users first.…