How to set up an Ubuntu VPS (first steps after you get root)

You've paid, you have root, and you're staring at a fresh Ubuntu 24.04 prompt. This is the first ten minutes done right: get the box patched, off root, behind keys and a firewall. Copy-paste, in order.

1. Update the system

apt update && apt upgrade -y

A fresh image is rarely fully patched. Do this first, every time.

2. Create a non-root sudo user

Don't run as root day-to-day. Make a normal user and give it sudo:

adduser deploy            # set a password when prompted
usermod -aG sudo deploy

3. Add your SSH key to that user

From your own machine you already generated a key (how to set up SSH keys). Install its public half for the new user:

# on the server, as root
mkdir -p /home/deploy/.ssh
# paste your PUBLIC key into authorized_keys
nano /home/deploy/.ssh/authorized_keys
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh && chmod 600 /home/deploy/.ssh/authorized_keys

Open a second terminal and confirm ssh deploy@YOUR.SERVER.IP works before the next step — so a mistake can't lock you out.

4. Turn off password and root SSH login

Once the key works:

sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

Now only your key gets in, and the constant brute-force noise on port 22 bounces off.

5. Enable the firewall

Allow SSH before enabling, then only what you need:

sudo ufw allow OpenSSH
sudo ufw enable          # confirms; SSH stays open

Full details in how to configure a UFW firewall.

6. Turn on automatic security updates

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades   # choose "Yes"

The box now patches its own security updates while you sleep.

That's the baseline

Patched, off root, key-only, firewalled, auto-updating — that's a sane starting point for anything. Next steps depending on what you're building:

• Harden further — the full new-VPS security checklist and fail2ban.
• Run containers — install Docker.
• Serve a site — nginx reverse proxy with HTTPS.
• Keep something running — create a systemd service.

On Debian instead of Ubuntu? The steps are nearly identical — see how to set up a Debian VPS. EQVPS gives you a clean Ubuntu 24.04 image with root in about a minute, no KYC, paid in crypto.