A fresh VPS is reachable from the entire internet within seconds of booting, and automated bots start trying passwords almost immediately. Spending fifteen minutes on the basics below makes your server dramatically harder to break into — and saves you headaches later.

This tutorial uses Ubuntu 24.04 LTS, but almost every step works the same on 22.04 and on Debian.

Prerequisites

  • A VPS running Ubuntu 24.04 (any Ubuntu VPS plan works)
  • The server’s IP address and root password from your welcome email
  • A terminal: macOS and Linux have one built in; on Windows use Windows Terminal or PowerShell

Step 1 — Log in and update everything

Connect as root:

ssh [email protected]

Replace 203.0.113.10 with your server’s IP. Then install all pending updates:

apt update && apt full-upgrade -y

If a new kernel was installed, reboot now with reboot and log in again.

Step 2 — Create a regular user with sudo

Working as root all the time makes mistakes expensive. Create your own user and give it administrator rights through sudo:

adduser deploy
usermod -aG sudo deploy

adduser asks for a password and some optional details — only the password matters.

Step 3 — Set up SSH key authentication

SSH keys are far stronger than any password. On your local computer (not the server), generate a key pair if you don’t already have one:

ssh-keygen -t ed25519 -C "[email protected]"

Then copy the public key to the new user on your server:

ssh-copy-id [email protected]

Open a new terminal window and confirm you can log in without a password:

ssh [email protected]

Keep your root session open until you have confirmed key-based login works. If something goes wrong, you can still fix it — and the VNC console in your VPS control panel is always there as a last resort.

Step 4 — Disable password and root logins

Ubuntu 24.04 reads extra SSH settings from /etc/ssh/sshd_config.d/. Create a small drop-in file instead of editing the main config:

sudo tee /etc/ssh/sshd_config.d/99-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF

Check the configuration for errors, then restart SSH:

sudo sshd -t && sudo systemctl restart ssh

From now on, only users with an authorized key can log in, and root cannot log in over SSH at all.

Step 5 — Turn on the firewall

Ubuntu ships with UFW (Uncomplicated Firewall). Allow SSH first, then enable it:

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Open more ports only when you need them, for example for a web server:

sudo ufw allow 80,443/tcp

Step 6 — Automatic security updates

Ubuntu Server includes unattended-upgrades, which installs security patches automatically. Make sure it is enabled:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes when asked. Security updates will now be applied daily without any action from you.

Step 7 — Add swap on small plans

On plans with 2 GB of RAM, a swap file gives you a safety net against out-of-memory crashes during spikes:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Verify it with free -h.

Step 8 — Set the time zone (optional)

Logs are easier to read in your own time zone:

sudo timedatectl set-timezone America/New_York

List all options with timedatectl list-timezones.

Your checklist

Task Command / file
Update packages apt update && apt full-upgrade
Sudo user adduser + usermod -aG sudo
SSH keys only /etc/ssh/sshd_config.d/99-hardening.conf
Firewall ufw allow OpenSSH && ufw enable
Auto security updates unattended-upgrades
Swap /swapfile in /etc/fstab

Next steps

Your server is now ready for real work. From here you might want to install Docker, set up a WordPress site, or deploy your own application behind Nginx.

Don’t have a server yet? Ubuntu VPS plans start with instant setup and a 7-day money-back guarantee.

  • Ubuntu
  • Security
  • SSH