Initial VPS Setup: The First 10 Minutes on a New Ubuntu Server

You just purchased a shiny new VPS from DigitalOcean, Hetzner, Vultr, or any cloud provider. Your terminal is staring back at you with a blinking cursor. The next ten minutes are the most critical — they determine whether your server becomes a hardened fortress or an open door for attackers.

Every day, automated bots scan millions of IP addresses looking for freshly provisioned servers with default configurations. Within minutes of your VPS going live, SSH brute-force attempts begin. This guide walks you through the essential first steps to lock down your Ubuntu server, step by step, command by command.

Step 1: Log In via SSH for the First Time

Your hosting provider gave you an IP address and root credentials (either a password or an SSH key). Open your terminal and connect:

You are now logged in as root. This is both powerful and dangerous — every command you run has unlimited access to the system. Our first priority is to reduce our exposure by creating a dedicated user account.

Step 2: Change the Root Password

Many providers send the root password in plain text via email. Change it immediately to something strong and unique:

Step 3: Create a New Sudo User

Running everything as root is a recipe for disaster. A mistyped destructive command could wipe your entire system. Create a regular user with sudo privileges instead:

Now verify that your new user can actually use sudo. Open a new terminal tab (keep your root session open as a backup) and test:

Step 4: Set Up SSH Key Authentication

Passwords are vulnerable to brute-force attacks. SSH keys are cryptographically secure and effectively impossible to guess. On your local machine (not the server), generate an SSH key pair:

Test that key-based login works before changing any SSH configuration:

Step 5: Disable Password Authentication

Now that SSH keys work, disable password login entirely. This is the single most impactful security change you can make:

Step 6: Configure UFW Firewall

A firewall is your server's front door. By default, Ubuntu does not enable UFW (Uncomplicated Firewall), leaving all ports open. Let us fix that:

Here is what each rule does and why it matters:

Step 7: Enable Automatic Security Updates

Unpatched vulnerabilities are one of the top attack vectors. Ubuntu's unattended-upgrades package automatically installs security patches:

For additional control, you can configure what gets updated by editing /etc/apt/apt.conf.d/50unattended-upgrades. The default settings update security packages only, which is the safest option for production servers.

Step 8: Set Timezone and Hostname

Correct time is essential for log analysis, SSL certificates, cron jobs, and debugging. Set your timezone and a meaningful hostname:

Step 9: Create a Swap File

Many VPS instances come with limited RAM and no swap. If your server runs out of memory, the kernel's OOM killer will terminate processes randomly — often killing your database or web server. A swap file provides breathing room:

The recommended swap size depends on your RAM:

Step 10: Install Essential Tools

Install the utilities you will need for day-to-day server management:

Here is what each package provides:

Quick Setup for Fail2Ban

Fail2Ban monitors log files for suspicious activity and automatically bans offending IP addresses. The default configuration protects SSH:

The Complete 10-Minute Checklist

Here is every step in order with approximate time estimates:

Bonus: Quick Security Audit After Setup

Once everything is configured, run this quick audit to verify your setup:

What About Changing the SSH Port?

Many guides recommend changing the default SSH port from 22 to something like 2222 or 2847. This is "security through obscurity" — it reduces log noise from automated bots but does not stop a determined attacker. Here is a balanced view:

If you do change the port, update both UFW and your SSH config:

Next Steps After the First 10 Minutes

Your server is now reasonably secure for a fresh installation. Depending on your use case, your next steps will be:

Or Skip Everything: Install Panelica

Everything in this guide — and much, much more — is automated by Panelica. Instead of spending 10 minutes on basic setup (and hours on the follow-up configuration), you can have a production-ready server in about 3 minutes:

With Panelica installed, you get out of the box: