Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps Print

You just deployed a fresh Ubuntu 24.04 LTS VPS — congratulations. Before you host anything on it, spend ten minutes on this initial server setup. A brand-new server with a root password and every port answering to the internet is a target: automated bots start probing new IP addresses within minutes of them coming online. This guide walks you through the ten steps our engineers at LFA IT apply to every Ubuntu server we manage.

Prerequisites

You need a freshly installed Ubuntu 24.04 (or 22.04) server — a VPS, cloud instance or dedicated machine — plus its IP address and the root password or SSH key you set at deployment. On Windows, use Windows Terminal or PuTTY; on macOS and Linux, the built-in terminal is all you need.

Step 1 — Log in for the first time

ssh root@your_server_ip

Accept the host-key fingerprint prompt with yes. If your provider emailed you a password, you will be asked for it now.

Step 2 — Update every package

New images are always weeks behind on patches. Bring the system fully up to date first:

apt update && apt upgrade -y

If a new kernel was installed, reboot with reboot before continuing. For details on keeping the system patched automatically, see our guide on updating Ubuntu and enabling unattended upgrades.

Step 3 — Create a sudo user (stop using root)

Day-to-day work as root is risky — one mistyped command can take the server down, and a leaked root password is game over. Create a regular user and give it administrative rights:

adduser deploy
usermod -aG sudo deploy

Test it before you log out of root: su - deploy then sudo whoami should print root. Full details in our sudo user guide.

Step 4 — Set up SSH keys

Passwords can be brute-forced; SSH keys practically cannot. From your local machine:

ssh-keygen -t ed25519 -C "[email protected]"
ssh-copy-id deploy@your_server_ip

Then confirm you can log in as deploy without a password prompt.

Step 5 — Harden the SSH daemon

Edit /etc/ssh/sshd_config and set:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Apply with sudo systemctl restart ssh. Our complete SSH hardening guide covers custom ports, rate limiting and more.

Step 6 — Enable the UFW firewall

ufw allow OpenSSH
ufw enable
ufw status verbose

Only open what you actually use — typically 80/tcp and 443/tcp for a web server. See the full UFW configuration guide.

Step 7 — Install Fail2Ban

Fail2Ban watches your logs and bans IPs that fail to log in repeatedly — it kills brute-force attacks almost completely:

apt install fail2ban -y

Setup and jail configuration are covered in our Fail2Ban tutorial.

Step 8 — Set the hostname and timezone

hostnamectl set-hostname web01.example.com
timedatectl set-timezone Asia/Beirut

Correct time matters for logs, cron jobs and TLS. More in hostname and timezone configuration.

Step 9 — Add swap space

Small VPS plans (1–2 GB RAM) should always have swap to survive memory spikes:

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile

Make it permanent following our swap space guide.

Step 10 — Enable automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

What next?

Your Ubuntu server is now safe to build on. Popular next steps: install a LAMP stack or LEMP stack for websites, secure them with a free Lets Encrypt SSL certificate, or run applications in containers with Docker.

Related Ubuntu guides

• How to Create a Sudo User on Ubuntu 24.04 and Disable Root Login
• How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices
• How to Set Up UFW Firewall on Ubuntu 24.04: Complete Configuration Guide
• How to Install Fail2Ban on Ubuntu 24.04 to Stop Brute-Force Attacks
• How to Update Ubuntu Server: apt, Security Patches and Unattended Upgrades