Securing a newly provisioned Ubuntu 24.04 VPS: a weekend guide

October 2026 is European Cybersecurity Month: the ECSM campaign, coordinated by ENISA with the European Commission, runs from 01 October 2026 to 31 October 2026. A good opportunity to methodically revisit the basics of securing a freshly provisioned Ubuntu 24.04 VPS. Nothing exotic: these are the same six steps that any reputable provider expects before putting a server into production. Here, every step has its verification command, so readers can confirm it actually worked.

1. Non-root user with sudo

First access: create a dedicated user and add it to the sudo group before doing anything else.

adduser deploy
usermod -aG sudo deploy

Verification: id deploy should show the sudo group among secondary groups. From this point on, work from there—root remains only for emergencies.

2. SSH key instead of password

Ubuntu Server's official documentation recommends the ed25519 key for smaller size and lower computational cost compared to RSA: We recommend the ed25519 Elliptic Curve algorithm ( -t ed25519 ) due to shorter key size and lower computational requirements. From the client:

ssh-keygen -t ed25519
ssh-copy-id deploy@SERVER_IP

Before closing the password session, open a second terminal and test login with the key. Only if it works should you proceed. For troubleshooting, the same documentation recommends following the logs in real time on the target server: sudo journalctl -fu ssh.service.

3. Disable SSH root login

Create a dedicated snippet instead of modifying the main configuration file—a practice recommended by Ubuntu documentation because any settings defined in files within sshd_config.d/ will override those in the main configuration file:

echo "PermitRootLogin no" | sudo tee /etc/ssh/sshd_config.d/99-hardening.conf
echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config.d/99-hardening.conf
sudo sshd -t
sudo systemctl restart ssh.service

Running sudo sshd -t before restart is what prevents you being locked out of the server: the same documentation warns that if your only method of access to a server is SSH, and you make a mistake when configuring sshd you may find you are locked out.

4. Firewall with ufw

On Ubuntu the firewall is not active by default: ufw by default is initially disabled. Open only the SSH port, then enable it:

sudo ufw allow 22
sudo ufw enable
sudo ufw status verbose

The last command shows the status and active rules, including default policies for outbound and inbound traffic.

5. fail2ban against brute-force attempts

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

The sshd jail should be configured in a local file (/etc/fail2ban/jail.local) to avoid losing your changes on the next package update. fail2ban-client status sshd shows failed attempts and currently banned IPs.

6. Automatic security updates

On server images, the package is already present: Ubuntu 24.04 includes unattended-upgrades by default, but verify it's installed. Check and reconfigure if needed:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
sudo systemctl status apt-daily.timer
sudo systemctl status apt-daily-upgrade.timer

Since Ubuntu 24.04, there's a change compared to earlier versions: this is handled by the needrestart(1) package, which unattended-upgrades calls after applying updates. Starting with Ubuntu 24.04 LTS, needrestart restarts the affected services automatically by default. Check whether a critical service (database, job queue) should be excluded from this behaviour, adding it to the needrestart exceptions list.

Six steps, six verification commands. Repeat every time you provision a new VPS, not just in October.