Hardening Linux Infrastructure: Designing an SSH Jump Server with Automated UFW Blocking

Why Direct SSH Exposure Is a Critical Risk

Exposing management ports (TCP 22) directly to the open internet results in thousands of automated dictionary attacks and Hydra brute-force attempts every day. Even with key-based authentication, continuous connection spikes consume CPU cycles, exhaust daemon connection pools, and generate overwhelming log noise.

To solve this, we designed and evaluated a **Secure SSH Jump Server with Automated Intrusion Detection and Access Control**.

The Architecture: Jump Server as Gatekeeper

An SSH Jump Server (Bastion Host) sits between the public network and isolated internal server clusters. No internal database or application node allows direct public connections; engineers must first authenticate through the Bastion Host.

[ Public Internet ] 
        │
        ▼ (SSH Port 22)
[ Secure Bastion Host ]  ────► (Real-Time Auth Watcher) ────► [ UFW Auto-Blocker ]
        │                                                            │
        │ (Encrypted Internal Subnet)                                ▼
        ▼                                                   [ Incident Telemetry ]
[ Internal Database & App Servers ]

Real-Time Detection & Automated Firewall Dropping

Traditional Fail2ban installations often run with polling delays or generic thresholds. In our research environment, we engineered a dedicated Python stream processor that tails `/var/log/auth.log` asynchronously.

When repeated invalid user attempts or rapid-fire failed passwords breach defined heuristics within a 15-second window, the system immediately invokes the Linux kernel firewall:

ufw insert 1 deny from <ATTACKER_IP> to any

Controlled Simulation Results

We subjected the architecture to rigorous penetration tests using THC-Hydra generating 50 concurrent login attempts per second. The intrusion detection pipeline classified the signature within 1.8 seconds and inserted the kernel drop rule before the attacker could test 10 passwords, neutralizing the threat with 0% false positives for authorized keys.