Ubuntu Linux Server

This guide was written for Ubuntu Server 26.04 LTS.

For a VPS provider, I highly recommend Hostinger. I personally use their KVM 2 plan to host my website and a few other services:

2 vCPU cores
8 GB RAM
100 GB NVMe disk space
8 TB bandwidth

Check for system updates

apt update && apt upgrade -y

If you see Some sources can be modernized. Run 'apt modernize-sources' to do so, run the following command:

apt modernize-sources

Switch to a limited user account

You should switch to a limited user account as soon as possible.

Delete or rename an existing user

Some platforms create a default limited user account (e.g., ubuntu) for you. For security reasons, you should delete or rename the account.

List all existing users:
Terminal window
```
awk -F: '$3 >= 1000 && $3 < 65534 {print $1}' /etc/passwd
```
And their home directories:
Terminal window
```
ls -l /home
```

Either delete the existing user, group, and home directory:

pkill -u ubuntu
deluser --remove-home ubuntu
delgroup ubuntu

Or rename the existing user, group, and home directory, replacing new_username with your desired username:

usermod -l new_username ubuntu
groupmod -n new_username ubuntu

mv /home/ubuntu /home/new_username
usermod -d /home/new_username -m new_username
chown -R new_username:new_username /home/new_username

Add a new user

Create a new user, changing example_userto your preferred user name:
Terminal window
```
adduser example_user
```
Give the user sudo access to be able to run commands as root:
Terminal window
```
adduser example_user sudo
```

Open the sshd config file in a text editor:
Terminal window
```
sudo nano /etc/ssh/sshd_config
```
Press Ctrl+F, type PermitRootLogin, and press Enter to find the setting.
Either comment it out, or change it to prohibit-password or no.

The default is prohibit-password, which only allows SSH key based logins.
Press Ctrl+X, then Y, and finally Enter to save the file.

Enable the firewall

Allow SSH through the firewall:
Terminal window
```
sudo ufw allow "OpenSSH"
```
Enable logging:
Terminal window
```
sudo ufw logging on
```
Start the firewall:
Terminal window
```
sudo ufw enable
```

Enable brute force protection

Use Fail2Ban to automatically block IP addresses with too many failed login attempts.

Install fail2ban:
Terminal window
```
sudo apt install -y fail2ban
```
Check the current status of all jails (to see what’s automatically protected):
Terminal window
```
sudo fail2ban-client status --all
```