{"id":139,"date":"2026-10-16T22:13:28","date_gmt":"2026-10-16T20:13:28","guid":{"rendered":"https:\/\/nodeguard.io\/blog\/?p=139"},"modified":"2026-10-18T20:20:21","modified_gmt":"2026-10-18T18:20:21","slug":"how-to-set-up-an-ubuntu-vps","status":"publish","type":"post","link":"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/","title":{"rendered":"How to Set Up an Ubuntu VPS: 10 Easy, Essential First Steps"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A fresh server feels great for about five minutes. Then you realise it is already on the public internet, and automated bots are knocking on port 22 before you have finished your coffee. That is why knowing how to set up an Ubuntu VPS properly matters more than whichever app you plan to install first. The steps below take roughly 30 to 45 minutes, work on any recent Ubuntu LTS release (including 24.04 and 26.04), and leave you with a server that is patched, locked down and ready for real workloads.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want a clear answer to how to set up an Ubuntu VPS without missing anything, here are the ten things to do first, in the order that keeps you safest: update the system, create a non-root user, switch to SSH keys, harden SSH, turn on a firewall, block brute-force attempts, automate security patches, fix time and hostname, add swap, and take a backup. Copy the commands, but read the reasons too. Understanding why each step exists is what makes a secure Ubuntu server far easier to maintain six months from now.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist-1024x576.webp\" alt=\"vps security checklist\" class=\"wp-image-142\" srcset=\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist-1024x576.webp 1024w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist-300x169.webp 300w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist-768x432.webp 768w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist-900x506.webp 900w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-checklist.webp 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">In This Guide<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#How_to_Set_Up_an_Ubuntu_VPS_What_You_Need_First\" >How to Set Up an Ubuntu VPS: What You Need First<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#1_Log_In_and_Update_the_System\" >1. Log In and Update the System<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#2_Create_a_Non-Root_Sudo_User\" >2. Create a Non-Root Sudo User<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#3_Set_Up_SSH_Key_Authentication\" >3. Set Up SSH Key Authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#4_Harden_SSH_Disable_Root_and_Password_Login\" >4. Harden SSH: Disable Root and Password Login<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#5_Enable_the_UFW_Firewall\" >5. Enable the UFW Firewall<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#6_Install_and_Configure_Fail2Ban\" >6. Install and Configure Fail2Ban<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#7_Turn_On_Automatic_Security_Updates\" >7. Turn On Automatic Security Updates<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#8_Set_the_Timezone_Time_Sync_and_Hostname\" >8. Set the Timezone, Time Sync and Hostname<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#9_Add_Swap_Space_If_Your_VPS_Is_Small\" >9. Add Swap Space (If Your VPS Is Small)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#10_Back_Up_and_Snapshot_Before_You_Install_Anything\" >10. Back Up and Snapshot Before You Install Anything<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#What_to_Do_After_the_First_Ten\" >What to Do After the First Ten<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Common_Mistakes_to_Avoid\" >Common Mistakes to Avoid<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#How_long_does_it_take_to_set_up_an_Ubuntu_VPS\" >How long does it take to set up an Ubuntu VPS?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Which_Ubuntu_version_should_I_choose_for_a_new_VPS\" >Which Ubuntu version should I choose for a new VPS?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Is_it_safe_to_leave_the_root_account_enabled_on_a_VPS\" >Is it safe to leave the root account enabled on a VPS?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Do_I_really_need_both_UFW_and_Fail2Ban\" >Do I really need both UFW and Fail2Ban?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Can_I_run_these_steps_on_any_Ubuntu_VPS_provider\" >Can I run these steps on any Ubuntu VPS provider?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/nodeguard.io\/blog\/how-to-set-up-an-ubuntu-vps\/#Final_Thoughts_on_How_to_Set_Up_an_Ubuntu_VPS\" >Final Thoughts on How to Set Up an Ubuntu VPS<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_Set_Up_an_Ubuntu_VPS_What_You_Need_First\"><\/span>How to Set Up an Ubuntu VPS: What You Need First<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You need four things: a VPS running an Ubuntu LTS release, the server&#8217;s IP address, the initial login details from your provider, and an SSH client (the built-in terminal on Linux and macOS, or Windows Terminal and PowerShell on Windows). Keep a second terminal window handy as well. You will use it as a safety net in step 4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have not chosen a server yet, NodeGuard&#8217;s <a href=\"https:\/\/nodeguard.io\/cloud-vps\">Cloud VPS plans<\/a> let you pick Ubuntu 24.04 or 26.04 when you deploy. And if you are still unsure whether a VPS is the right type of hosting for your project, our guide to <a href=\"https:\/\/nodeguard.io\/blog\/vps-vs-shared-hosting\">VPS vs shared hosting<\/a> explains the trade-offs in plain language.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One convention used throughout: replace <code>YOUR_SERVER_IP<\/code> with your server&#8217;s address and <code>deploy<\/code> with the username you prefer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Log_In_and_Update_the_System\"><\/span>1. Log In and Update the System<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first stage of how to set up an Ubuntu VPS is simply getting in. Connect to the server as root using the credentials your provider gave you:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh root@YOUR_SERVER_IP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Before anything else, bring every package up to date. The image your VPS was built from may be weeks or months old, which means it can already be missing security fixes.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt update &amp;&amp; apt upgrade -y\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When the upgrade finishes, check whether the system is asking for a restart:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91; -f \/var\/run\/reboot-required ] &amp;&amp; echo \"Reboot needed\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If it says a reboot is needed (usually after a kernel update), run <code>reboot<\/code>, wait a minute, and log back in. Doing this now is far less painful than doing it later with a live website on the machine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Create_a_Non-Root_Sudo_User\"><\/span>2. Create a Non-Root Sudo User<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The next part of how to set up an Ubuntu VPS safely is to stop using root. Working as root all day is risky. One mistyped command, such as a stray <code>rm -rf<\/code> in the wrong directory, has no safety net. A normal user with sudo rights gives you the same power but forces a deliberate step before anything destructive happens, and it leaves an audit trail in the logs.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adduser deploy\nusermod -aG sudo deploy\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Pick a strong password when prompted, even though you will soon disable password logins entirely. That password is still what <code>sudo<\/code> asks for. Open your second terminal window and confirm the new account works:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh deploy@YOUR_SERVER_IP\nsudo whoami\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the second command prints <code>root<\/code>, the account is set up correctly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Set_Up_SSH_Key_Authentication\"><\/span>3. Set Up SSH Key Authentication<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Passwords can be guessed, reused or leaked. An SSH key pair cannot be guessed in any practical sense: it consists of a private key that stays on your computer and a public key that lives on the server. On your <strong>local machine<\/strong> (not the server), generate a modern Ed25519 key:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-keygen -t ed25519 -C \"you@yourlaptop\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Give the key a passphrase. If someone ever steals your laptop, the passphrase is the last line of defence for the private key. Then copy the public key to your new user:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-copy-id deploy@YOUR_SERVER_IP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now log in again with <code>ssh deploy@YOUR_SERVER_IP<\/code>. You should be let in using the key (you may be asked for the key passphrase, not the account password). Do not move on until this works, because the next step depends on it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Harden_SSH_Disable_Root_and_Password_Login\"><\/span>4. Harden SSH: Disable Root and Password Login<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you only remember one thing about how to set up an Ubuntu VPS, make it this: it is the single most valuable change in any Ubuntu server initial setup. Once only keys are accepted, the endless password-guessing attempts you will see in your logs become harmless noise.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create a small drop-in file rather than editing the main config. The <code>00-<\/code> prefix matters: OpenSSH uses the first value it reads for each setting, and some provider images ship a file that re-enables password login.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/ssh\/sshd_config.d\/00-hardening.conf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add these lines:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PermitRootLogin no\nPasswordAuthentication no\nKbdInteractiveAuthentication no\nPubkeyAuthentication yes\nMaxAuthTries 3<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Think of this as the harden SSH Ubuntu step: five lines that remove most of the risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Always validate the syntax before applying it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sshd -t\nsudo systemctl reload ssh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now the safety net. <strong>Do not close your current session.<\/strong> Open a brand-new terminal and try <code>ssh deploy@YOUR_SERVER_IP<\/code>. If it works, you are done. If it fails, your existing session is still open and you can fix the file. This one habit prevents most self-inflicted lockouts. For every available option, the <a href=\"https:\/\/www.openssh.com\/manual.html\" target=\"_blank\" rel=\"noopener\">OpenSSH manual<\/a> is the authoritative reference.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some guides also suggest changing the SSH port. It reduces log noise slightly but is not real security, so we leave it out of the ten.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"5_Enable_the_UFW_Firewall\"><\/span>5. Enable the UFW Firewall<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">No guide on how to set up an Ubuntu VPS is complete without a firewall. A firewall closes every door you are not deliberately using. Ubuntu ships with UFW (Uncomplicated Firewall), which is a friendly front end for the kernel&#8217;s packet filtering. A correctly configured UFW firewall Ubuntu setup takes under two minutes. The golden rule for a UFW firewall on Ubuntu is to allow SSH <strong>before<\/strong> you enable it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw allow OpenSSH\nsudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp\nsudo ufw enable\nsudo ufw status verbose\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ports 80 and 443 are for web traffic, so skip them if this server will not host a website. Whenever you install a new service later, open only the port it needs. If you want more detail on rule syntax, the <a href=\"https:\/\/help.ubuntu.com\/community\/UFW\" target=\"_blank\" rel=\"noopener\">Ubuntu UFW documentation<\/a> is a good companion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One caveat worth remembering: containers published through Docker can bypass UFW rules, so if you add Docker later, check your exposed ports with <code>sudo ss -tulpn<\/code> rather than assuming the firewall has you covered. Combined with SSH keys, this is what makes a secure Ubuntu server hard to break into.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"6_Install_and_Configure_Fail2Ban\"><\/span>6. Install and Configure Fail2Ban<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Even with keys only, bots will keep hammering your SSH port, wasting resources and filling your logs. Fail2Ban watches log files and temporarily bans IP addresses that fail too many times. It is a lightweight and effective layer for any VPS security checklist, yet many tutorials on how to set up an Ubuntu VPS skip it.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install fail2ban -y\nsudo nano \/etc\/fail2ban\/jail.local\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add a basic configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;DEFAULT]\nbantime  = 1h\nfindtime = 10m\nmaxretry = 5<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;sshd]\nenabled = true<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then enable and start it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl enable --now fail2ban\nsudo fail2ban-client status sshd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The status command shows how many addresses are currently banned. Do not be surprised if the number is already above zero within the first day. The project&#8217;s <a href=\"https:\/\/github.com\/fail2ban\/fail2ban\" target=\"_blank\" rel=\"noopener\">Fail2Ban documentation<\/a> explains how to add jails for other services such as web servers.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers-1024x576.webp\" alt=\"how to set up an ubuntu vps\" class=\"wp-image-143\" srcset=\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers-1024x576.webp 1024w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers-300x169.webp 300w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers-768x432.webp 768w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers-900x506.webp 900w, https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/first-10-things-ubuntu-vps-security-layers.webp 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"7_Turn_On_Automatic_Security_Updates\"><\/span>7. Turn On Automatic Security Updates<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Staying patched is a core part of how to set up an Ubuntu VPS that stays secure. Most real-world server compromises exploit vulnerabilities that already have a fix available. The fix just was not installed. Ubuntu&#8217;s <code>unattended-upgrades<\/code> package applies security patches automatically so you are not relying on your memory.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install unattended-upgrades -y\nsudo dpkg-reconfigure -plow unattended-upgrades\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Choose &#8220;Yes&#8221; when asked. By default it installs only security updates, which is the safe choice for production. It does not upgrade major versions or surprise you with big changes. You can review what it has done at any time in <code>\/var\/log\/unattended-upgrades\/<\/code>. Keep in mind that some updates, mainly kernel ones, need a reboot to take effect, so plan a short maintenance window every few weeks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"8_Set_the_Timezone_Time_Sync_and_Hostname\"><\/span>8. Set the Timezone, Time Sync and Hostname<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This step looks cosmetic, but accurate time is essential. Log timestamps, TLS certificates, cron jobs and security tools all depend on the clock being right. Start by checking the current state:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>timedatectl\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for &#8220;System clock synchronized: yes&#8221;. Ubuntu normally handles synchronisation out of the box, so you only need to set the timezone. Many administrators choose UTC for servers, because it avoids confusion with daylight-saving changes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo timedatectl set-timezone UTC\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then give the server a meaningful hostname. A name like <code>web-01<\/code> or <code>app-prod<\/code> tells you at a glance which machine you are logged into, which matters a lot once you manage more than one:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo hostnamectl set-hostname web-01\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"9_Add_Swap_Space_If_Your_VPS_Is_Small\"><\/span>9. Add Swap Space (If Your VPS Is Small)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Small servers can run out of memory during an update, a build or a traffic spike, and when that happens the kernel&#8217;s out-of-memory killer starts terminating processes, often your database. A modest swap file is cheap insurance. First check whether swap already exists:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>swapon --show\nfree -h\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If it is empty and your VPS has 2 GB of RAM or less, create a swap file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fallocate -l 2G \/swapfile\nsudo chmod 600 \/swapfile\nsudo mkswap \/swapfile\nsudo swapon \/swapfile\necho '\/swapfile none swap sw 0 0' | sudo tee -a \/etc\/fstab\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To make the server prefer RAM and only touch swap when needed, lower the swappiness value:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo 'vm.swappiness=10' | sudo tee \/etc\/sysctl.d\/99-swappiness.conf\nsudo sysctl --system\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Swap is a safety valve, not a substitute for memory. If you rely on it constantly, the real fix is a bigger plan. If you reach that point, our comparison of <a href=\"https:\/\/nodeguard.io\/blog\/vps-vs-cloud-hosting\">VPS vs cloud hosting<\/a> can help you decide how to scale.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"10_Back_Up_and_Snapshot_Before_You_Install_Anything\"><\/span>10. Back Up and Snapshot Before You Install Anything<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You now have a clean, hardened baseline. That makes this the perfect moment to capture it. If a later experiment goes wrong, you can roll back to this exact state in minutes instead of rebuilding from scratch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use two kinds of protection, because they solve different problems:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Snapshots<\/strong> capture the whole server at a point in time. They are ideal before risky changes such as major upgrades. Take one right now and label it something like <code>baseline-hardened<\/code>.<\/li>\n\n\n\n<li><strong>File-level backups<\/strong> copy the data that actually matters (databases, uploads, configuration) to a separate location. A snapshot stored next to the server it protects is not enough if the account or platform has a problem.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Follow the 3-2-1 rule where you can: three copies of your data, on two different types of storage, with one copy off-site. And remember that a backup you have never restored is only a hope. Test a restore at least once. Also check what backup schedule comes with your plan, so you know exactly what is covered and what you need to handle yourself. Make this a fixed part of every routine you follow for how to set up an Ubuntu VPS, not an afterthought.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_to_Do_After_the_First_Ten\"><\/span>What to Do After the First Ten<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Now that you know how to set up an Ubuntu VPS safely, you can finally install what the server is for: a web server such as Nginx, a database, a runtime like Node.js or Python, or a control panel. A few habits will keep the setup healthy over time:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check <code>sudo fail2ban-client status sshd<\/code> and <code>sudo ufw status<\/code> occasionally.<\/li>\n\n\n\n<li>Reboot after kernel updates during a quiet window.<\/li>\n\n\n\n<li>Add monitoring so you hear about disk, memory and CPU problems before your visitors do.<\/li>\n\n\n\n<li>Document what you changed. Even three lines in a text file will save you hours later.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you are still deciding whether a VPS or a bare-metal machine suits your workload, our guide to <a href=\"https:\/\/nodeguard.io\/blog\/vps-vs-dedicated-server\">VPS vs dedicated server<\/a> walks through the decision step by step.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Common_Mistakes_to_Avoid\"><\/span>Common Mistakes to Avoid<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most problems when people learn how to set up an Ubuntu VPS come from a handful of avoidable errors:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Enabling UFW before allowing SSH.<\/strong> This locks you out instantly. Always run <code>sudo ufw allow OpenSSH<\/code> first.<\/li>\n\n\n\n<li><strong>Disabling password login before testing the key.<\/strong> Confirm a key-based login works in a second window first.<\/li>\n\n\n\n<li><strong>Closing your only SSH session after changing sshd settings.<\/strong> Keep it open until a fresh login succeeds.<\/li>\n\n\n\n<li><strong>Skipping backups &#8220;for now&#8221;.<\/strong> The day you need one is never planned.<\/li>\n\n\n\n<li><strong>Running everything as root.<\/strong> It is faster in the short term and far more dangerous in the long term.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_long_does_it_take_to_set_up_an_Ubuntu_VPS\"><\/span>How long does it take to set up an Ubuntu VPS?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Following this guide on how to set up an Ubuntu VPS takes about 30 to 45 minutes the first time, and closer to 15 once you are familiar with them. Most of that time is spent testing logins and reading output, which is exactly where care pays off.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Which_Ubuntu_version_should_I_choose_for_a_new_VPS\"><\/span>Which Ubuntu version should I choose for a new VPS?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Choose a Long Term Support (LTS) release, such as 24.04 or 26.04. LTS versions receive security updates for years, which is what you want for production. The commands in this guide are the same on both.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_it_safe_to_leave_the_root_account_enabled_on_a_VPS\"><\/span>Is it safe to leave the root account enabled on a VPS?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It is better to disable direct root login over SSH, as shown in step 4. Root remains available through <code>sudo<\/code> for your admin user, but attackers lose the one username they are guaranteed to try first.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Do_I_really_need_both_UFW_and_Fail2Ban\"><\/span>Do I really need both UFW and Fail2Ban?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, because they do different jobs. UFW decides which ports can be reached at all, while Fail2Ban reacts to bad behaviour on the ports you leave open. Together with key-only SSH, they form a layered defence, so one failure does not expose the whole server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Can_I_run_these_steps_on_any_Ubuntu_VPS_provider\"><\/span>Can I run these steps on any Ubuntu VPS provider?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. The method for how to set up an Ubuntu VPS in this guide uses standard Ubuntu tools, so it works on any provider&#8217;s Ubuntu image, whether you are on a small starter plan or a larger machine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Final_Thoughts_on_How_to_Set_Up_an_Ubuntu_VPS\"><\/span>Final Thoughts on How to Set Up an Ubuntu VPS<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Learning how to set up an Ubuntu VPS is mostly about doing a few unglamorous things in the right order: update, create a sudo user, use SSH keys, harden SSH, enable a firewall, add Fail2Ban, automate updates, fix time, add swap and take a backup. None of it is difficult, and all of it pays off the first time a bot swarm hits your server and finds nothing to grab.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ready to practise how to set up an Ubuntu VPS? Deploy a server on NodeGuard&#8217;s <a href=\"https:\/\/nodeguard.io\/cloud-vps\">Cloud VPS<\/a> and follow this checklist while you build. Your future self will thank you.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n","protected":false},"excerpt":{"rendered":"<p>A fresh server feels great for about five minutes. Then you realise it is already on the public internet, and automated bots\u2026<\/p>\n","protected":false},"author":2,"featured_media":144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,22,25],"tags":[36,70,71,35,43,38,41,69,39,34],"class_list":["post-139","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-performance-and-tuning","category-server-management","tag-fail2ban","tag-linux-server-setup","tag-nodeguard","tag-server-hardening","tag-ssh-keys","tag-ubuntu-26-04","tag-ubuntu-server","tag-ubuntu-vps","tag-ufw-firewall","tag-vps-security"],"_links":{"self":[{"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/posts\/139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/comments?post=139"}],"version-history":[{"count":5,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/posts\/139\/revisions"}],"predecessor-version":[{"id":150,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/posts\/139\/revisions\/150"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/media\/144"}],"wp:attachment":[{"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/media?parent=139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/categories?post=139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nodeguard.io\/blog\/wp-json\/wp\/v2\/tags?post=139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}