Weekend Guide: Secure a New Ubuntu 24.04 Server in One Hour

A freshly created Ubuntu 24.04 VPS arrives with only a root user and no security barriers. Within minutes of first SSH connection, automated scanners start knocking on port 22. This is the checklist we use on every new machine, command by command, with verification at the end of each section. Estimated time: one hour, less if you've done it nine times already.

1. Non-root user with sudo

First connection as root, then immediately:

adduser deploy
usermod -aG sudo deploy

Verify the user is in the correct group:

groups deploy

sudo should appear in the list. From here onwards, always work as deploy, never as root.

2. Disable root login via SSH

Modify /etc/ssh/sshd_config:

sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Verify from a second terminal without closing the current session:

ssh root@SERVER-IP

It should refuse the connection. If login still works, the file was not saved or the service did not restart properly.

3. Fail2ban against brute-force attacks

sudo apt update
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

Verify:

sudo systemctl status fail2ban
sudo fail2ban-client status sshd

The first command should show active (running), the second should list currently banned IPs (empty on a new server, which is normal).

4. Firewall with ufw

The most common rule mistake: always allow SSH before enabling ufw, because the default behaviour denies all incoming connections without an explicit rule.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Verify:

sudo ufw status verbose

Should show Status: active with all three rules for port 22 (OpenSSH), 80 and 443 marked as ALLOW. After enabling the firewall, don't close your current SSH session immediately: test a new connection from a second terminal first.

5. Automatic security updates

On Ubuntu Server 24.04 the unattended-upgrades package is installed and enabled by default, and Ubuntu's official documentation confirms that automatic security updates are active immediately after installation. Still worth checking:

sudo apt update
sudo apt install -y unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades

The file should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

By default only security updates are applied: the Allowed-Origins block in /etc/apt/apt.conf.d/50unattended-upgrades enables -security origins and leaves regular updates for manual application. For those who prefer to leave nothing to chance, the configuration should be forced explicitly:

sudo dpkg-reconfigure -plow unattended-upgrades

Verify that the timer is active:

systemctl status unattended-upgrades
systemctl list-timers | grep apt

6. Minimal backup

A minimal backup does not replace a provider snapshot, but covers configuration:

sudo mkdir -p /root/backup-config
sudo tar czf /root/backup-config/etc-$(date +%F).tar.gz /etc/ssh /etc/ufw /etc/fail2ban

Verify the archive exists and is not empty:

ls -lh /root/backup-config/

From here, moving it off the server (to object storage, another host, or a control panel snapshot) is the next step and depends on your provider: we'll cover automated backups in a dedicated guide.

At this point the server has: a dedicated user, root locked down via SSH, fail2ban active, firewall with only ports 22/80/443 open, automatic security patches and a minimal copy of the configuration. It's not everything, but it's the foundation that must be in place before putting anything into production.