Ubuntu Server Setup

Harden and configure a fresh Ubuntu 24.04 LTS server (also works on 22.04) from first login to production-ready state.

Initial Login & Update

After provisioning, SSH in as root and perform a full system update before anything else.

# Update package list and upgrade all packages
apt update && apt full-upgrade -y

# Set your timezone
timedatectl set-timezone America/New_York

Create a Non-Root User

Never operate a production server as root. Create a dedicated admin user.

# Create a new user
adduser deploy

# Add to sudo group
usermod -aG sudo deploy

# Switch to the new user
su - deploy

SSH Hardening

Disable password authentication and root login to lock down SSH access.

# Copy your public key to the server (run from your local machine)
ssh-copy-id deploy@your.server.ip

# Then on the server, edit sshd_config
sudo nano /etc/ssh/sshd_config

Set these values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222          # optional: change default port

sudo systemctl restart ssh

Ubuntu 24.04 note: SSH starts through ssh.socket, so a new Port in sshd_config is ignored until you reload the socket. Also check /etc/ssh/sshd_config.d/: a cloud-init file there can turn PasswordAuthentication back on. Keep your current session open and test a second login before you log out.

sudo grep -r PasswordAuthentication /etc/ssh/sshd_config.d/
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
sudo sshd -t   # config syntax check, no output means OK

Configure UFW Firewall

sudo ufw limit 2222/tcp   # or: sudo ufw limit OpenSSH if you kept port 22 (limit = allow + brute-force rate limit)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

Install Fail2Ban

Automatically ban IPs that repeatedly fail to authenticate.

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

# Check banned IPs
sudo fail2ban-client status sshd

Enable Unattended Upgrades

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Add Swap Space (Optional)

Recommended for servers with less than 2GB RAM.

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# Make permanent
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Last updated October 2026.

FAQ

What should I do first on a new Ubuntu server?

Install updates, create a normal user with sudo, set up SSH keys, enable the UFW firewall and turn on automatic security updates.

Which Ubuntu version should I use for a server?

The latest LTS release (Ubuntu 24.04 LTS). LTS versions get five years of standard security updates.