Initial Server Setup with Ubuntu 24.04

A brand-new Linux server arrives with just one account — root, the all-powerful administrator — protected by a single password. That’s fine for the first few minutes, but it’s not safe to leave that way. In about 15 minutes this guide gives you your own everyday user, a firewall, a much safer key-based login and automatic security updates. Do this first, before you install anything else. No experience needed — you’ll copy and paste every command, and after each one we’ll show you exactly what you should see.

Two rules for the whole guide: wherever you see your_server_ip, type your own IP address instead (it looks like 203.0.113.42). And wherever you see sam, use whatever username you’d like for yourself — we just picked sam as an example.

1Step 1: Log in as root

Open your terminal (PowerShell on Windows, Terminal on Mac/Linux), type the line below with your own IP in place of your_server_ip, and press Enter:

$ ssh root@your_server_ip

The very first time, it asks whether you trust this server:

The authenticity of host '203.0.113.42' can't be established.
ED25519 key fingerprint is SHA256:a1b2c3d4e5f6...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes and press Enter. Next it asks for your password — type or paste your root password and press Enter.

You’re in when the start of the line changes to something like this — it means you’re now typing commands on your server:

root@your-server:~#

2Step 2: Install the latest updates

First, bring the server fully up to date so you start from a clean, patched system. Copy this, press Enter, and give it a minute — it prints a lot of text and finishes back at the # prompt:

$ apt update && apt upgrade -y

3Step 3: Create your own user

Working as root all the time is risky — one wrong command can wipe the whole system. Instead you’ll make a normal user for day-to-day work and give it admin powers through sudo (you type sudo in front of a command only when you actually need admin rights). Create the user:

$ adduser sam

It asks you to set a password, then a few optional details:

Adding user `sam' ...
Creating home directory `/home/sam' ...
New password:
Retype new password:
...
Full Name []:
Room Number []:
...
Is the information correct? [Y/n]

Choose a strong password (nothing shows while you type it, same as before). For Full Name and the other questions you can just press Enter to leave them blank, then press Y and Enter to confirm. Now give sam admin rights:

$ usermod -aG sudo sam

This command prints nothing, which means it worked.

4Step 4: Turn on the firewall

A firewall decides what’s allowed to reach your server. Ubuntu includes a simple one called UFW. We’ll make sure it’s installed, switch it on, and — importantly — allow SSH first, so you don’t lock yourself out:

$ apt install -y ufw
$ ufw allow OpenSSH
$ ufw enable

When it warns that this may disrupt existing connections, type y and press Enter.

Check what’s now allowed:

$ ufw status

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)

Later, when you install something like a website or a game server, you open its port the same way — for example ufw allow 80/tcp for a website.

5Step 5: Set up an SSH key

An SSH key is a pair of files — a public one that lives on the server and a private one that stays on your computer. Together they let you log in without typing a password, and they’re far harder to break than any password. These commands run on your own computer, not the server, so open a new terminal window and pick your system:

$ ssh-keygen -t ed25519

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
...
Your identification has been saved in /home/you/.ssh/id_ed25519

$ ssh-copy-id sam@your_server_ip

Number of key(s) added: 1

ssh-keygen -t ed25519

Generating public/private ed25519 key pair.
Enter file in which to save the key (C:\Users\you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
...
Your identification has been saved in C:\Users\you/.ssh/id_ed25519

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh sam@your_server_ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Now test it. Log in as your new user:

$ ssh sam@your_server_ip

It should log you straight in without asking for sam’s password (if you set a passphrase on the key, it asks for that instead). You’ll land at sam’s prompt — note the $ instead of #, which shows you’re a normal user now:

sam@your-server:~$

6Step 6: Turn off password and root logins

Your key works, so there’s no reason to let anyone log in with a password or as root anymore — turning both off stops the constant automated password-guessing that every public server gets. Logged in as sam, open a new settings file:

$ sudo nano /etc/ssh/sshd_config.d/00-sable-hardening.conf

nano is a simple text editor right in the terminal. The first time you use sudo it may ask for sam’s password. Type these two lines into the empty file:

PasswordAuthentication no
PermitRootLogin no

Save and close: press Ctrl + O then Enter to save, then Ctrl + X to exit. Check the settings are valid, then apply them:

$ sudo sshd -t
$ sudo systemctl restart ssh

If sshd -t prints nothing at all, your settings are fine — silence is success here. (If it prints an error, reopen the file and check the two lines match exactly.)

7Step 7: Turn on automatic security updates

Finally, let the server install security fixes by itself so you don’t have to remember to. As sam, run:

$ sudo apt install -y unattended-upgrades
$ sudo dpkg-reconfigure -plow unattended-upgrades

A blue full-screen box appears asking “Automatically download and install stable updates?” — use the arrow keys if needed to highlight <Yes> and press Enter. That’s it: your server now installs security updates on its own, every day.

What’s next?

Your server is secured and ready for real work. From now on, always log in as sam (ssh sam@your_server_ip) and put sudo in front of admin commands. A great first project: host a Minecraft server for you and your friends. If you get stuck on any step, our team in Nova Scotia is on the help desk and Discord.

More guides