Secure a new Ubuntu VPS

Run these as root on a fresh Ubuntu or Debian VPS. Keep a second terminal open while changing SSH settings so you can't lock yourself out.

1. Update everything

apt update && apt upgrade -y

2. Create a normal user

adduser deploy
usermod -aG sudo deploy

3. Add your SSH key

On your own computer generate a key if you don't have one (ssh-keygen -t ed25519), then copy it:

ssh-copy-id deploy@YOUR_SERVER_IP

Test ssh deploy@YOUR_SERVER_IP in a new terminal before continuing.

4. Disable password and root login

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Then systemctl restart ssh.

5. Turn on the firewall

See Set up a firewall with UFW.

6. Block brute force attempts

apt install fail2ban -y
systemctl enable --now fail2ban

7. Automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

Take a snapshot or backup once you're happy with the setup.