Secure a New Ubuntu 24.04 Server: The First 10 Steps

A new internet-facing server starts getting login attempts within minutes. These ten steps take about 15 minutes on Ubuntu 24.04 LTS (they work on Debian too) and remove the most common ways in.

Golden rule: whenever you touch SSH settings, keep your current session open and test a second login in another terminal before you close anything.

1. Update everything

sudo apt update && sudo apt full-upgrade -y
sudo reboot        # if a new kernel was installed

2. Create a normal user with sudo

sudo adduser deploy
sudo usermod -aG sudo deploy

3. Install your SSH key for that user

From your own computer:

ssh-copy-id deploy@SERVER_IP
ssh deploy@SERVER_IP          # confirm it works without a password

4. Turn off root login and passwords

Create a drop-in file. The name matters: SSH uses the first value it finds, and cloud images often ship 50-cloud-init.conf with PasswordAuthentication yes, so your file must sort before it.

sudo tee /etc/ssh/sshd_config.d/01-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
EOF
sudo sshd -t && sudo systemctl reload ssh
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'

Open a new terminal and confirm you can still log in. Only then close the old one.

5. Enable the firewall

Allow SSH before you enable it:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw limit OpenSSH          # allows SSH but rate-limits brute force
sudo ufw allow 80,443/tcp       # only if this is a web server
sudo ufw enable
sudo ufw status verbose

Note: Docker publishes ports by editing iptables directly and can bypass UFW. Don't assume a published container port is blocked.

6. Install fail2ban

It bans IPs that keep failing to log in.

sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.local >/dev/null <<'EOF'
[sshd]
enabled  = true
maxretry = 5
findtime = 10m
bantime  = 1h
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

7. Automatic security updates

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Check it later with systemctl status unattended-upgrades and /var/log/unattended-upgrades/.

8. See what is listening

Every open port is attack surface. Close or bind to localhost anything you don't need:

sudo ss -tlnp

Databases (MariaDB, PostgreSQL, Redis) should listen on 127.0.0.1 only, unless you deliberately expose them.

9. Keep time correct

Certificates, logs and 2FA all depend on it. Ubuntu enables systemd-timesyncd by default:

timedatectl status          # "System clock synchronized: yes"

10. Back up, and test the restore

Security isn't only about attackers; a dead disk is just as final. Schedule database dumps and a copy of your web root and /etc, store a copy off the server, and actually try restoring once.

Bonus: quick self-audit

sudo apt install -y lynis
sudo lynis audit system

Lynis lists warnings and suggestions with a hardening score. Don't chase 100, fix the high-impact warnings.

Summary