A fresh Ubuntu Server installation is only the starting point. Before hosting applications, you should establish a predictable baseline: patch the system, create an administrative account, set the hostname and time zone, verify networking, secure SSH, enable the firewall, and configure automatic security updates.
sudo. Keep your current session open while changing SSH or network settings, and test a second connection before logging out.1. Confirm the system and collect a baseline
Start by recording the release, kernel, address, route, storage, and memory state:
cat /etc/os-release
uname -r
hostnamectl
ip -br address
ip route
df -hT
free -h
The release should be Ubuntu 24.04 LTS. Save this output with your server inventory so future troubleshooting has a known baseline.
2. Update installed packages
sudo apt update
apt list --upgradable
sudo apt upgrade -y
sudo apt autoremove --purge -y
Check whether the updated kernel or libraries require a reboot:
if [ -f /var/run/reboot-required ]; then
cat /var/run/reboot-required
fi
If a reboot is required, schedule it before continuing and reconnect afterward:
sudo systemctl reboot
3. Set the hostname and local name resolution
Replace web01.example.com with the server’s real fully qualified domain name:
sudo hostnamectl set-hostname web01.example.com
hostnamectl
hostname --fqdn
Add a local entry using the server’s address. Do not remove the existing localhost lines:
sudoedit /etc/hosts
127.0.0.1 localhost
127.0.1.1 web01.example.com web01
For public services, also create the appropriate DNS A and/or AAAA records at your DNS provider.
4. Configure the time zone and verify synchronization
List available zones and select the one appropriate for the server. UTC is generally easiest for distributed infrastructure:
timedatectl list-timezones | less
sudo timedatectl set-timezone UTC
timedatectl status
Ubuntu Server uses a time synchronization service. Confirm that the clock is synchronized:
systemctl status systemd-timesyncd --no-pager
timedatectl timesync-status
5. Create a separate administrative user
Do not use the root account for routine administration. Create a named account and add it to the sudo group:
sudo adduser deploy
sudo usermod -aG sudo deploy
id deploy
sudo -l -U deploy
Test the account locally or in a second session:
su - deploy
sudo whoami
The final command should print root. Exit back to the original account after the test.
6. Install OpenSSH and configure key authentication
Install and enable the SSH server:
sudo apt install openssh-server -y
sudo systemctl enable --now ssh
sudo systemctl status ssh --no-pager
sudo ss -lntp | grep ':22'
On your local workstation—not on the server—create an Ed25519 key if you do not already have one:
ssh-keygen -t ed25519 -a 100 -C "deploy@workstation"
ssh-copy-id deploy@SERVER_IP
Open a second terminal and verify that key authentication works:
ssh deploy@SERVER_IP
sudo whoami
Do not disable password authentication until this test succeeds.
7. Harden the SSH service
Create a drop-in file instead of editing the distribution configuration directly:
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 30
EOF
Validate the effective configuration before reloading SSH:
sudo sshd -t
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries'
sudo systemctl reload ssh
Keep the existing session open and test another login. If access fails, remove the drop-in from the console and reload SSH:
sudo rm -f /etc/ssh/sshd_config.d/99-hardening.conf
sudo sshd -t && sudo systemctl reload ssh
8. Enable the UFW firewall safely
Allow SSH before enabling UFW. If administrators connect only from a trusted subnet, restrict the source address:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# More restrictive alternative:
# sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp
sudo ufw enable
sudo ufw status verbose
For a web server, add HTTP and HTTPS later with sudo ufw allow 'Nginx Full' or the matching application profile. Do not open unused ports.
9. Configure a static IP with Netplan (optional)
Cloud servers usually receive networking from cloud-init or provider metadata; changing Netplan there can break connectivity. For a physical server or VM on a managed LAN, first identify the interface and existing configuration:
ip -br link
ls -l /etc/netplan/
sudo netplan get
The following example assigns 192.168.10.20/24 to ens18. Replace every value to match your network:
sudo tee /etc/netplan/99-static.yaml > /dev/null <<'EOF'
network:
version: 2
renderer: networkd
ethernets:
ens18:
dhcp4: false
addresses:
- 192.168.10.20/24
routes:
- to: default
via: 192.168.10.1
nameservers:
addresses:
- 1.1.1.1
- 8.8.8.8
EOF
YAML indentation is significant. Validate the file, then use netplan try; it automatically rolls back unless you confirm the new network:
sudo netplan generate
sudo netplan try
ip -br address
ip route
resolvectl status
ping -c 3 1.1.1.1
getent hosts ubuntu.com
Use console access for remote network changes. After confirming connectivity, apply the configuration permanently with sudo netplan apply.
10. Enable automatic security updates
Ubuntu 24.04 normally includes unattended-upgrades, but explicitly install and enable it:
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
systemctl list-timers | grep -E 'apt-daily|apt-daily-upgrade'
Review the active periodic settings and perform a dry run:
cat /etc/apt/apt.conf.d/20auto-upgrades
sudo unattended-upgrade --dry-run --debug
sudo tail -n 100 /var/log/unattended-upgrades/unattended-upgrades.log
On production systems, review automatic service restarts and coordinate maintenance windows before changing reboot behavior.
11. Install a small administration toolkit
sudo apt install curl wget vim git htop jq unzip dnsutils net-tools lsof -y
Only install tools your team uses. Fewer packages mean fewer components to patch and audit.
12. Run the final validation
hostnamectl
timedatectl status
ip -br address
ip route
resolvectl status
sudo systemctl --failed
sudo ufw status verbose
sudo sshd -t
sudo journalctl -p err -b --no-pager
apt list --upgradable
Investigate any failed unit or boot error instead of ignoring it. Finally, test a new SSH login from an authorized workstation and confirm that an unauthorized password login is rejected.
Initial setup checklist
- Ubuntu reports the expected release, kernel, CPU, memory, and storage.
- All current security and package updates are installed.
- The hostname, DNS records, time zone, and clock synchronization are correct.
- A named administrator can use
sudo. - SSH key authentication works and direct root login is disabled.
- UFW permits only required inbound services.
- Network changes were tested with rollback protection.
- Automatic security updates are enabled and monitored.
systemctl --failedreports no unexpected failed services.
References: Ubuntu Server security suggestions, Ubuntu network configuration, Ubuntu automatic updates, and the Server World Ubuntu 24.04 topic index.
