Secure Ubuntu Server and Debian in 5 steps

How to secure Ubuntu Server in about 10 minutes

Your new server is live. This guide secures it in five steps. It works on Ubuntu and Debian, and takes about 10 minutes.

You will update the system, make your own user, log in with an SSH key, turn off root and password login, and turn on a firewall.

Before you start

• A server with Ubuntu or Debian
• The IP address and root password of your server
• A terminal on your own computer: Terminal on macOS and Linux, PowerShell or Windows Terminal on Windows
• About 10 minutes

Step 1: Log in and update

Log in to your server as root. Replace your-server-ip with the IP address of your server.

~ $ ssh root@your-server-ip

Then update all packages. This takes a minute or two.

~ $ apt update && apt upgrade -y

Step 2: Create your own user

Working as root all the time is risky. One typo can break the whole system. So make your own user, and give it sudo rights. In this example, the user is called kai.

~ $ adduser kai
~ $ usermod -aG sudo kai

Pick a strong password when adduser asks for one. You need it for sudo.

Step 3: Add an SSH key

An SSH key is safer than a password. Run these commands on your own computer, not on the server.

Make a key. Press Enter to accept the default location, and pick a passphrase if you like.

~ $ ssh-keygen -t ed25519

Copy the key to your server:

~ $ ssh-copy-id kai@your-server-ip

On Windows, ssh-copy-id is often missing. Copy the contents of C:\Users\<you>\.ssh\id_ed25519.pub into /home/kai/.ssh/authorized_keys on the server instead.

Now test it in a new terminal window:

~ $ ssh kai@your-server-ip

Keep your old session open while you test. If the key works, you log in without the account password. Only then go to step 4.

Step 4: Turn off root and password login

Now only your key should get in. Log in as kai and open the SSH config:

~ $ sudo nano /etc/ssh/sshd_config

Find these two lines, remove the # in front if there is one, and set them to no:

PermitRootLogin no
PasswordAuthentication no

Save with Ctrl+O, Enter, and close with Ctrl+X.

Also check the folder /etc/ssh/sshd_config.d/. On recent Ubuntu versions, a file there (often 50-cloud-init.conf) can turn password login back on. Set PasswordAuthentication no there too.

Then restart SSH:

~ $ sudo systemctl restart ssh

Test again in a new window before you close your old session.

Step 5: Turn on the firewall

UFW is a simple firewall for Ubuntu and Debian. Install it, and allow SSH first so you keep access:

~ $ sudo apt install ufw
~ $ sudo ufw allow OpenSSH
~ $ sudo ufw enable
~ $ sudo ufw status

The status shows OpenSSH ALLOW Anywhere. Open more ports only when you need them, for example sudo ufw allow 80,443/tcp for a web server.

Bonus: Fail2ban and automatic updates

Fail2ban blocks IP addresses that keep guessing passwords. Unattended upgrades installs security updates for you.

~ $ sudo apt install fail2ban unattended-upgrades
~ $ sudo dpkg-reconfigure unattended-upgrades

On Ubuntu and Debian, Fail2ban protects SSH right after install.

Locked out? Use the KVM console

Every Hostner server comes with a KVM console. It works like a screen and keyboard on your server, so you can reach it even when SSH fails.

Open the KVM console in your client area, log in, and fix the setting that locked you out. For example, set PasswordAuthentication yes again, or run sudo ufw allow OpenSSH.

FAQ

Quick checklist

• System updated
• Own user with sudo rights
• SSH key works in a new window
• Root login and password login off, also in sshd_config.d
• UFW on, with SSH allowed
• Fail2ban and unattended upgrades installed

Need a server to try this on? Dedicated servers from €49.99 a month, with root access and a KVM console.