A new Ubuntu VPS gives you control over the operating system, but it also makes you responsible for access, updates, firewall rules, and recovery. This checklist covers a safe baseline for a fresh server before you deploy a website, API, or other service.
The commands below run on the VPS unless noted. They assume you can connect with the provider's initial account and that it has sudo access. Keep the provider's web or serial console available in case a network or SSH change interrupts access.
If you are still choosing a plan, our guide to finding hosting that works for your needs covers hosting models and operational responsibilities. For a provider-specific example, the HostZealot Ubuntu VPS page shows one commercial offer; compare it with alternatives rather than treating it as a recommendation.
1. Install updates and plan for recovery
Refresh package information and install available updates:
sudo apt update
sudo apt upgrade
Read the package manager's proposed changes before confirming. If the update requires a reboot, schedule one when a brief outage is acceptable. Ubuntu Server's automatic updates guide explains how to check unattended security updates and reboot behavior; automatic updates do not replace backups or recovery planning.
Before making changes that could affect access or data, confirm you can use your provider's recovery console and have a restorable backup or snapshot. A snapshot on the same provider is useful for rollback, but is not a substitute for a separate backup.
2. Create a named administrator
Use a regular account with sudo rather than enabling direct root login. Replace admin with the account name you want:
sudo adduser admin
sudo usermod -aG sudo admin
Choose a strong account password when prompted. Keep the provider's initial account until you have confirmed that the new account can sign in and run administrative commands:
sudo -v
Ubuntu's user management documentation covers user and group administration. You do not need to set a root password to manage the server.
3. Set up SSH key access before tightening SSH
Generate a key on your own computer, not on the VPS. On a system with OpenSSH, an Ed25519 key is a suitable default:
ssh-keygen -t ed25519 -a 64 -C "you@example.com"
Protect the private key with a passphrase. Copy only its .pub file to the new account:
ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@SERVER_IP
On Windows, run ssh-keygen and ssh from PowerShell or use WSL; if ssh-copy-id is unavailable, add the public-key contents to the account's ~/.ssh/authorized_keys using the provider console. Never copy or paste the private key onto the server.
If the provider's initial account already uses key-only SSH and the new account cannot authenticate with a password, use the current authenticated session or provider console to install the public key for admin. Set the .ssh directory to mode 700 and authorized_keys to mode 600, owned by admin.
Open a second terminal and test the new login and sudo access before changing SSH settings:
ssh admin@SERVER_IP
sudo -v
After key access works, you can disable root and password-based SSH login. On Ubuntu, create a drop-in configuration file:
sudoedit /etc/ssh/sshd_config.d/00-local-hardening.conf
Add these settings:
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
Validate the configuration before reloading the SSH service:
sudo sshd -t
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '
sudo systemctl reload ssh
Keep your existing session open and test a new key-based connection before closing it. If validation fails or the new login does not work, use the existing session or provider console to correct the configuration. See Ubuntu's current OpenSSH server guide for configuration details. Changing SSH from its default port is not a substitute for updates and key-based access.
4. Enable the firewall without locking yourself out
Check whether UFW is already active. If it is, review the existing rules instead of replacing its policy blindly. On a fresh server, allow SSH and any services you will expose before enabling the firewall:
sudo ufw status verbose
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# Add these only if this server will accept web traffic:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose
If SSH uses a non-default port, allow that exact TCP port instead of relying on the OpenSSH profile.
Do not open ports for services you are not using. VPS providers can also have a separate network firewall or security group; allow the required traffic there as well. Ubuntu's firewall guide explains UFW and its rules.
5. Check time and keep the system maintained
Inspect the current time, time zone, and synchronization status:
timedatectl status
timedatectl list-timezones
Set a time zone if the server needs one other than UTC:
sudo timedatectl set-timezone Region/City
Replace Region/City with a name from the available list. Ubuntu normally configures time synchronization as part of the server setup; check timedatectl status and follow the documentation for your Ubuntu release if the clock is not synchronized. See the timedatectl manual for its options.
Keep security updates enabled, monitor whether updates require a reboot, and test that backups can actually be restored. Before deploying an application, review which ports it needs and how you will monitor disk space, logs, and service health.
Further reading
- Install Ubuntu Server if you still need to install the operating system.
- Setup Ubuntu VPS: First Few Steps (2020; older supplementary notes).
- First configuration steps on a new VPS server (2018; community notes).
Cover Photo by Gabriel Heinzer on Unsplash