How to Set Up and Secure a New Ubuntu VPS (Initial Server Setup) Print

How to Set Up and Secure a New Ubuntu VPS

After deploying a new Ubuntu VPS, securing the server should be your first priority. A properly configured VPS reduces unauthorized access attempts, protects your applications, and provides a reliable foundation for hosting websites, Docker containers, and databases.

This guide explains how to perform the initial setup and security hardening of an Ubuntu 24.04 LTS or Ubuntu 26.04 LTS VPS.

1. Update Your Ubuntu VPS

Connect to your VPS using SSH:

ssh root@YOUR_SERVER_IP

Update the system and install essential security utilities:

apt update && apt upgrade -y
apt install -y sudo curl wget git unzip ufw fail2ban unattended-upgrades

2. Create a Sudo User

Using the root account for daily administration is not recommended. Create a separate user with administrative privileges:

adduser adminuser
usermod -aG sudo adminuser

Replace adminuser with your preferred username.

3. Configure SSH Key Authentication

SSH keys provide stronger authentication than passwords. Generate an Ed25519 key pair on your local computer:

ssh-keygen -t ed25519

Copy your public key to the new VPS user:

ssh-copy-id adminuser@YOUR_SERVER_IP

Test the connection:

ssh adminuser@YOUR_SERVER_IP

Important: Verify that SSH key authentication works before disabling password authentication. Keep your original SSH session open while testing.

4. Harden SSH Configuration

Create a dedicated SSH configuration file:

sudo nano /etc/ssh/sshd_config.d/99-hardening.conf

Add the following settings:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Validate the SSH configuration and reload the service:

sudo sshd -t
sudo systemctl reload ssh

Verify the effective SSH configuration:

sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication'

Note: OpenSSH configuration files can contain earlier settings that take precedence. If the effective values do not match the intended configuration, review /etc/ssh/sshd_config and the files under /etc/ssh/sshd_config.d/ before disconnecting.

5. Configure the UFW Firewall

Ubuntu includes UFW, a straightforward firewall management tool.

Allow SSH before enabling the firewall:

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

If you plan to host websites, allow HTTP and HTTPS traffic:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

If your SSH service uses a custom port, allow that port before enabling UFW. Only expose services that require external access.

6. Install and Configure Fail2ban

Fail2ban monitors authentication failures and can temporarily block IP addresses associated with repeated unsuccessful login attempts.

Create an SSH protection configuration:

sudo nano /etc/fail2ban/jail.d/sshd.local

Add:

[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h

Enable Fail2ban and verify its SSH jail:

sudo systemctl enable --now fail2ban
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

7. Enable Automatic Security Updates

Keeping your VPS updated helps protect against known vulnerabilities.

Configure unattended security updates:

sudo dpkg-reconfigure unattended-upgrades

Enable automatic updates when prompted.

Check the configuration and update timers:

cat /etc/apt/apt.conf.d/20auto-upgrades
systemctl list-timers 'apt-daily*'

8. Verify Your VPS Security

After completing the initial setup, verify the firewall, SSH configuration, Fail2ban protection, and listening services:

sudo ufw status verbose
sudo fail2ban-client status sshd
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication'
sudo ss -tulpen

Your Ubuntu VPS now has a baseline security configuration suitable for deploying websites, applications, and development environments.

Additional Ubuntu VPS Tutorials

Continue configuring your server with these Owned Networks guides:

• How to Install Docker and Docker Compose on Ubuntu
• How to Host WordPress on an Ubuntu VPS with Nginx and Free SSL
• How to Install Coolify on an Ubuntu VPS

Deploy a Secure Ubuntu VPS with Owned Networks

Need a reliable Linux VPS for your next project? Owned Networks offers KVM VPS hosting with full root access, flexible resources, and SSD/NVMe storage options.

Explore Owned Networks VPS Hosting Plans and deploy your Ubuntu server today.