Secure a new Linux server: first 10 steps (Ubuntu)

On a new Ubuntu server: install updates, create a sudo user with an SSH key, turn off root and password logins, then add UFW, Fail2ban and automatic updates.

1. Install all updates

Connect as root (see Connect to your server with SSH) and update the system:

apt update
apt full-upgrade -y

If the second command updated the kernel, the server needs a restart. This shows whether one is waiting:

cat /var/run/reboot-required

If it prints *** System restart required ***, restart with reboot and connect again after a minute. "No such file" means no restart is needed.

2. Create your own user with sudo rights

Work as a normal user and use sudo only for admin commands. Create the user and add it to the sudo group:

adduser alex
usermod -aG sudo alex

adduser asks for a password (you need it for sudo) and some optional details; press Enter to skip those. Some cloud images already come with a user such as ubuntu: you can use that one instead.

3. Give the new user your SSH key

If you already log in as root with an SSH key, copy it to the new user:

rsync --archive --chown=alex:alex ~/.ssh /home/alex

If you log in with a password and have no key yet, create one on your own computer and copy it to the server from there:

ssh-keygen -t ed25519
ssh-copy-id [email protected]

4. Test the new login before you change anything else

Keep the root session open. In a new terminal window on your computer, log in as the new user and check that sudo works:

ssh [email protected]
sudo whoami

sudo asks for alex's password and then prints root. Only go on when the key login and sudo both work. From now on, work as this user.

5. Turn off root login and password logins

Bots try passwords on every server all day. With these settings, only SSH keys are accepted and nobody can log in as root over SSH. Create a settings file:

sudo nano /etc/ssh/sshd_config.d/01-hardening.conf

Add these lines, then save with Ctrl+O, Enter, and close with Ctrl+X:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no

The name starts with 01 on purpose. SSH reads the files in that folder in alphabetical order and uses the first value it finds. Cloud images often have a file such as 50-cloud-init.conf there that turns password logins on; your file comes first and wins.

Check the settings for mistakes, then restart SSH:

sudo sshd -t
sudo systemctl restart ssh

sshd -t prints nothing when everything is fine. Confirm the values SSH really uses:

sudo sshd -T | grep -Ei '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication) '

All three should say no. Now test in a new terminal again: ssh [email protected] must still work, and ssh [email protected] should end with Permission denied (publickey). Close your old session only after that.

6. Switch on the firewall

sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Answer y when UFW warns that the command may disrupt existing SSH connections. Open the ports of the services you add later, for example sudo ufw allow 'Nginx Full' for a web server. More in Set up a firewall with UFW on Ubuntu.

7. Block password guessers with Fail2ban

Fail2ban watches the logins and blocks IP addresses that fail too often. On Ubuntu, the SSH protection is switched on as soon as it's installed:

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

The last command shows the failed attempts and the blocked addresses. To make sure you never block yourself, add your own IP address in a file of your own (never edit jail.conf, updates overwrite it):

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 203.0.113.25

Replace 203.0.113.25 with the IP address you work from, then reload with sudo systemctl restart fail2ban. To lift a block: sudo fail2ban-client set sshd unbanip 203.0.113.25.

8. Install security updates automatically

Ubuntu installs security updates by itself with unattended-upgrades. Check that it's switched on:

cat /etc/apt/apt.conf.d/20auto-upgrades

Both lines should end in "1". If the file is missing or shows "0", install and turn it on:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Test it without changing anything with sudo unattended-upgrade -v --dry-run. The logs are in /var/log/unattended-upgrades/. Kernel updates still need a restart: check /var/run/reboot-required now and then, or set Unattended-Upgrade::Automatic-Reboot "true"; and a time such as Unattended-Upgrade::Automatic-Reboot-Time "03:00"; in /etc/apt/apt.conf.d/50unattended-upgrades.

9. Check what's open to the internet

sudo ss -tulpn

The list shows every program that listens on a port. Addresses like 0.0.0.0, * or [::] mean "reachable from outside" (if the firewall lets it through). Remove or stop anything you don't need.

10. Plan for the day something goes wrong

• Find out how to reach your server without SSH, for example a VNC or rescue console, before you need it.
• Set up backups that are stored away from the server: Back up a server with rsync and cron.
• Keep your private SSH key safe and make a backup of it. Without it, and with password logins off, you can only get in through a console.

Common problems

Permission denied (publickey) for your own user

The key isn't in /home/alex/.ssh/authorized_keys, or the file's permissions are too open. As root (or through the console), check that the file contains your public key, then fix the owner and permissions:

chown -R alex:alex /home/alex/.ssh
chmod 700 /home/alex/.ssh
chmod 600 /home/alex/.ssh/authorized_keys

Password logins still work after step 5

Another file sets the value first. Run sudo grep -ri passwordauthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ to find it. Make sure your file's name sorts before the others, then restart SSH.

SSH doesn't come back after the restart

Usually a typing mistake in the settings file. Log in through the console, run sudo sshd -t to see the error, fix the file and restart SSH. This is why you test in a second window and keep the first one open.

You're locked out by the firewall or Fail2ban

Use the console. sudo ufw allow OpenSSH adds the missing rule; sudo fail2ban-client set sshd unbanip followed by your IP address removes a block.

Related articles

• Connect to your server with SSH
• Set up a firewall with UFW on Ubuntu
• Back up a server with rsync and cron
• Install a free SSL certificate with Certbot

Still stuck? Open a support ticket and we'll help.