Beginner ~30 min sudo required

Secure a New Ubuntu Server from Scratch

Take a freshly provisioned Ubuntu server from password-and-root to key-only access with a firewall, automatic security patches, and a verified way back in.

0 / 12 done

Prerequisites

A fresh Ubuntu server you can reach as root
An SSH key on your own machine, from the SSH Keys From Scratch guide
A second terminal window, kept open throughout

Step 1 Snippet

Update Ubuntu system packages

First command on any new server. Everything after this assumes current packages.

Step 2 Snippet

Create new sudo user

Username *

Daily work should never be done as root. This is the account you will use from now on.

Step 3 Snippet

Copy SSH Key to Remote Server

Remote User *

Server IP / Hostname *

Copy your key to the new user, not to root. Run it from your own machine, not from the server.

Step 4 Snippet

Do not skip this. Everything after it can lock you out, and this is the only step that proves you have a way back.

Verify a Second Login Before Closing the First

Username on the server *

Server address *

Step 5 Snippet

Disable Root SSH Login

Root is the account every bot tries first. Removing it as a target ends most of the noise in your logs.

Step 6 Snippet

The point of no return. Your key is now the only way in, so confirm the previous verification step passed.

Disable SSH Password Authentication

Every provider offers a console that reaches the machine without SSH: Hetzner and DigitalOcean call it Console, AWS calls it EC2 Serial Console. Find yours before you need it, not after.

Step 7 Snippet

Verify a Second Login Before Closing the First

Username on the server *

Server address *

Again, from a new terminal. This is the moment a mistake is still cheap to fix.

Step 8 Snippet

Allow SSH before enabling the firewall. Enabling first and allowing second cuts your own connection.

Enable UFW firewall with SSH

Step 9 Snippet

List All Listening Ports

Look at what is actually listening. Anything exposed that you did not intend is the next thing to close.

Step 10 Snippet

Install and Configure Fail2ban

Bans addresses that keep failing to authenticate. With passwords already off this is a second layer, not the first.

Step 11 Snippet

Enable Automatic Security Updates

The step that keeps working after you forget this server exists.

Step 12 Snippet

Set Server Timezone

Timezone *

Set it now so logs and scheduled jobs read in your own time when you are debugging at 2am.