Developer Guide

Intermediate•30–45 min

Set up a production Ubuntu server

Harden a fresh Ubuntu host with updates, a non-root operator, SSH keys, a firewall, automatic security updates, and basic intrusion protection.

1

Patch the server

Install available security and package updates before adding application software.

sudo apt update && sudo apt upgrade -y
2

Create an operator account

Use a named sudo account instead of operating as root.

sudo adduser <operator>
sudo usermod -aG sudo <operator>
3

Install the SSH public key

Copy only your public key to the new account, then confirm login from a second terminal.

ssh-copy-id <operator>@<server-ip>
ssh <operator>@<server-ip>

Important: Keep the current root session open until the new SSH login works.

4

Configure the firewall

Allow SSH before enabling UFW. Add HTTP and HTTPS when this host will serve web traffic.

Commandwarning
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status verbose
5

Harden SSH

After key login is verified, disable direct root login and password authentication in an SSH config drop-in.

sudoedit /etc/ssh/sshd_config.d/99-hardening.conf
sudo sshd -t && sudo systemctl reload ssh

Note: Set PermitRootLogin no and PasswordAuthentication no. Validate with sshd -t before reload.

6

Enable automated protection

Install unattended security updates and Fail2ban, then confirm both services.

sudo apt install -y unattended-upgrades fail2ban
sudo dpkg-reconfigure -plow unattended-upgrades
sudo systemctl enable --now fail2ban

Final verification

  • ✓ A second terminal can sign in with the operator SSH key
  • ✓ sudo ufw status shows only required inbound ports
  • ✓ sudo sshd -t exits successfully
  • ✓ systemctl is-active fail2ban returns active
Find related commandsBrowse all guides