How to Secure a Fresh Ubuntu VPS in 15 Minutes

A brand-new VPS is exposed to the internet the moment it boots. Within minutes, automated scanners will try default credentials and known exploits. This guide walks through the first 15 minutes on a fresh Ubuntu server so it is hardened before you deploy anything.

1. Log in and update

Connect as root using the password from your PingRack control panel, then bring the system up to date:

apt update && apt upgrade -y
apt install -y unattended-upgrades fail2ban ufw

Enable automatic security updates so you never miss a critical patch:

dpkg-reconfigure -plow unattended-upgrades

2. Create a sudo user and switch to SSH keys

Never run day-to-day work as root. Create a user, give it sudo, and copy your public key:

adduser deploy
usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

Then disable password logins and root SSH access in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH with systemctl restart ssh — but keep your current session open until you have confirmed the new login works in a second terminal.

3. Turn on the firewall

UFW gives you a sane default policy in three commands:

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw enable

Open only the ports you need later, for example ufw allow 80,443/tcp for a web server.

4. Stop brute-force attempts with fail2ban

fail2ban watches the auth log and bans IPs that fail repeatedly. The defaults are good; just make sure it is running:

systemctl enable --now fail2ban
fail2ban-client status sshd

5. A quick checklist before you deploy

• Root login disabled, key-only SSH ✔
• UFW enabled with deny-by-default ✔
• Automatic security updates on ✔
• fail2ban protecting SSH ✔
• Snapshots or backups scheduled in your backup plan ✔

Security is a habit, not a one-off task. Re-run this checklist whenever you provision a new server, or bake it into a cloud-init script.

For the official reference on SSH configuration, see the Ubuntu Server documentation.