Knowledge Base
0%
Beginner ~20 min sudo required

Secure a New Ubuntu Server from Scratch

Essential first steps after provisioning: create a sudo user, disable root login, enable UFW, and set up Fail2ban.

0 / 6 done

Prerequisites

  • Fresh Ubuntu server
  • Root SSH access

Sign in to track your progress across sessions.

1
Step 1 Command

Create sudo user

adduser deploy
usermod -aG sudo deploy
2
Step 2 Command

Copy SSH key to new user

# Run from your local machine:
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_SERVER_IP
3
Step 3 Command

Disable root SSH login

sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl reload ssh
4
Step 4 Command

Enable UFW firewall

ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable
ufw status verbose
5
Step 5 Command

Install and configure Fail2ban

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban
fail2ban-client status sshd
6
Step 6 Command

Update system packages

apt update && apt upgrade -y
apt autoremove -y