Initial Server Setup With Ubuntu: A New VPS Hardening Checklist
Goal
In this tutorial, you will take a freshly provisioned Ubuntu server from a bare root-only login to a hardened baseline with a non-root sudo user, SSH key authentication, a locked-down SSH daemon, and an active firewall.
Prerequisites
- A server/VPS running Ubuntu Linux
- The root password or root SSH access your VPS provider gave you
- A local machine with an SSH client (built into Linux, macOS, and modern Windows)
Let an AI agent do this for you
Copy a ready-made prompt for an AI coding assistant with terminal access to your server (Claude Code, Cursor, or similar) — it can carry out the steps below for you. Review what it plans to run before it executes anything.
A freshly provisioned Ubuntu VPS ships with a single root account reachable over SSH, usually with a password or a key the provider generated for you. That's convenient for the first login and unsafe for everything after it. This checklist gets a new server from "just root" to a reasonably hardened baseline: a non-root user with sudo, SSH key authentication, a locked-down SSH daemon, and a firewall. Do this before you install anything else on the box.
Step 1 — Log in as root
Connect to the server using the root credentials your provider gave you.
ssh [email protected]Replace 203.0.113.10 with your server's actual public IP address. On the very first connection you'll be asked to confirm the server's SSH host key fingerprint — type yes to continue.
Step 2 — Update installed packages
Refresh the package index and upgrade everything already installed. This pulls in any security fixes released since the base image was built.
apt update && apt upgrade -yStep 3 — Create a non-root user with sudo privileges
Doing daily work as root means any mistake, or any compromised process you run, has unrestricted access to the whole system. Create a separate account for normal use instead.
adduser deployYou'll be prompted for a password — choose a strong, unique one, ideally generated by a password manager — and then some optional account details you can skip by pressing Enter. Add the new user to the sudo group so it can run privileged commands with sudo:
usermod -aG sudo deployThe username deploy is just an example; use whatever you like, and use the same name in every command below.
Step 4 — Set up SSH key authentication
Password logins over SSH are exposed to brute-force scanning the moment a server is on the internet. An SSH key pair is stronger: the private key never leaves your local machine, and the server only ever sees the public half.
Generate a key pair (skip if you already have one)
On your LOCAL machine — not the server — check whether you already have a key:
ls ~/.ssh/id_ed25519.pubIf that file doesn't exist, generate a new key pair:
Tricknowtech VPS Hosting
Dedicated KVM resources and full root access — deployed in under 60 seconds, no ticket required.
Ready to try it yourself?
Create a free account and follow along.