A new server needs protection before you host a website, database, or application. To secure a new Ubuntu VPS, start with access controls, updates, and network restrictions. This checklist covers ten practical safeguards.
How to Secure a New Ubuntu VPS in 10 Steps
1. Choose a Supported Ubuntu Release
Deploy a supported Ubuntu LTS image from your provider. Record the server IP, hostname, and recovery-console details. Take an initial snapshot before changing access settings, and confirm you can restore it.
2. Install Security Updates
Update package lists and apply available patches:
sudo apt update && sudo apt upgrade -yRestart when a kernel or critical service update requires it. Check for failed package upgrades rather than assuming the command finished successfully.
3. Create a Separate Administrator Account
Avoid routine work as root. Create a named user and grant administrative access:
sudo adduser deploy
sudo usermod -aG sudo deployUse your own username instead of deploy. Verify the account can use sudo before restricting root login.
4. Set Up SSH Key Authentication
Generate an Ed25519 key on your computer if needed. Copy its public key to the new account with ssh-copy-id. Then open a second SSH session to confirm that key-based login works.
5. Harden SSH Without Locking Yourself Out
Once the new login works, set PermitRootLogin no, PasswordAuthentication no, and KbdInteractiveAuthentication no in an SSH server configuration drop-in. Check effective settings and syntax with sshd -T and sshd -t, then reload SSH. Keep the existing session and recovery console available until testing succeeds.
6. Enable a Firewall
Allow your actual SSH port before enabling UFW. For default SSH settings:
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseOpen ports 80 and 443 only if hosting a public website. Also check your provider firewall. Docker-published ports need extra attention because they can bypass some UFW filtering rules.
7. Check Automatic Security Updates
Ubuntu commonly includes unattended-upgrades by default. Confirm it is installed and scheduled. Review /etc/apt/apt.conf.d/20auto-upgrades and plan maintenance windows for required reboots. Follow Ubuntu’s official automatic-update guidance for configuration details.
8. Limit Login Attacks
Consider Fail2ban for services with exposed authentication endpoints. More importantly, restrict SSH to trusted source IPs when possible. Enable multi-factor authentication on your hosting control panel and protect recovery credentials.
9. Remove Unneeded Services
Run sudo ss -tulpn to identify listening ports. Stop unused daemons, uninstall unnecessary packages, and keep application dependencies updated. Give web apps and databases only the permissions they need.
10. Monitor and Back Up Regularly
Review SSH logs, disk usage, and suspicious processes. Set alerts for unusual resource spikes. Keep encrypted off-server backups and periodically test a full restore. A snapshot alone is not a backup strategy.
For self-managed deployments, CybroHost Linux VPS Hosting provides KVM resources and root access. Security configuration and ongoing maintenance remain your responsibility.
FAQs
Should I disable root SSH login immediately?
First confirm another sudo-enabled account and SSH key login work. Otherwise, you could lose remote access.
Is UFW enough to secure an Ubuntu VPS?
No. A firewall limits traffic, but patches, secure accounts, application settings, and backups are also essential.
Do I need Fail2ban if I use SSH keys?
It is optional for key-only SSH. Restricting network access and maintaining secure application logins still matter.
Final Recommendation
Secure remote access first, then restrict exposed services and enable routine maintenance. Recheck your setup after major updates or new application deployments.
