DEV Community

Cover image for How to Set Up and Secure an Ubuntu VPS from Scratch: A Beginner’s Blueprint
Arthur
Arthur

Posted on

How to Set Up and Secure an Ubuntu VPS from Scratch: A Beginner’s Blueprint

#ubuntu #devops #webdev #hosting

Setting up a Virtual Private Server (VPS) for the first time can feel overwhelming. Many developers simply spin up a fresh cloud instance, dump their application files onto it, and leave the default configurations active. This approach leaves your machine highly vulnerable to automated botnets, brute-force attacks, and severe resource bottlenecks that ruin your website loading speeds.

A production-ready environment requires strict security protocols, optimized user permissions, and a clean firewall setup before any deployment occurs.

Follow my step-by-step tutorial below to configure a fresh Ubuntu machine from scratch, secure its access channels, and optimize it for high-availability workloads.

Step 1: Authenticate and Connect via SSH

When your hosting provider installs your fresh operating system, they send you a temporary root password along with a public IP address. Open your local terminal or Command Prompt on Windows to initiate your first connection.

Replace YOUR_SERVER_IP with your actual machine IP:

ssh root@YOUR_SERVER_IP
Enter fullscreen mode Exit fullscreen mode

If it is your first time connecting to this host, your terminal will display an authenticity warning. Type yes and press enter, then paste your root password.

Step 2: Update System Packages and Repositories

Before configuring any server tools, you must sync your local package index with the global upstream distribution servers. This ensures your machine downloads the latest security patches.

Run the following unified command string:

sudo apt update && sudo apt upgrade -y
Enter fullscreen mode Exit fullscreen mode

The -y flag automatically inputs "yes" to system confirmation prompts during upgrading scripts.

Step 3: Create a Non-Root Privileged Deployment User

Running your daily development operations directly under the root account is a massive operational risk. A minor typing error in a system folder could delete critical kernel modules.

Let's create a distinct, secure user account named hellodev:

adduser hellodev
Enter fullscreen mode Exit fullscreen mode

The server will prompt you to assign a strong password. Pick a complex phrase, hit enter to bypass secondary profile fields, and confirm the changes.

Now, give this account administrative privileges by adding it to the system sudo group:

usermod -aG sudo hellodev
Enter fullscreen mode Exit fullscreen mode

Step 4: Configure Advanced SSH Key Authentication

Passwords can be cracked using brute-force algorithms. Public-key authentication requires a cryptographic key pair to log in, making unauthorized entry virtually impossible.

Open a new terminal window on your local machine to generate your local encryption keys:

ssh-keygen -t ed25519 -b 4096
Enter fullscreen mode Exit fullscreen mode

Now, push your new public key file securely up to your remote VPS server:

ssh-copy-id hellodev@YOUR_SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Test the connection by opening a fresh command session. You should log in instantly without typing a password:

ssh hellodev@YOUR_SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Step 5: Lock Down SSH Daemon Rules

Now that your secure key pairs are active, we must disable standard root access and password logins completely.

Open the system ssh daemon settings using the nano terminal editor:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Scroll through the text document, locate these specific configuration rules, and modify them to read as follows:

PermitRootLogin no
PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

Press CTRL + O to save your modifications, then exit the text program by hitting CTRL + X. Apply these hard security parameters by restarting your active machine SSH daemon service:

sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

Step 6: Activate the Uncomplicated Firewall (UFW)

An unprotected server processes connections across every available virtual network gate. We must restrict access so the machine only responds to specific, authorized services.

First, verify that your firewall software allows inbound SSH control requests, or you will get permanently locked out of your machine:

sudo ufw allow OpenSSH
Enter fullscreen mode Exit fullscreen mode

If your web applications require standard web entry points later, unlock access channels for HTTP and HTTPS data traffic:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Enter fullscreen mode Exit fullscreen mode

With your access rules in place, activate your live system security engine:

sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Type y to confirm the rule implementation. You can inspect your live firewall rule listings anytime by running: sudo ufw status verbose.

Step 7: Scale Seamlessly with Enterprise Infrastructure

Setting up your software configuration manually on raw terminals is a great learning milestone. However, running complex software on slow consumer architectures will still cause traffic bottlenecks and slow page loading speeds.

For large-scale business production networks, manually monitoring physical server health demands deep engineering time. If your company requires high-availability bare-metal servers, automated network monitoring, and fast enterprise NVMe storage environments tailored for global scalability, consider hosting your applications on Hello Server.

Deploying your code onto solid, optimized enterprise infrastructure ensures your live database workflows remain protected, stable, and performing at peak speeds around the clock.

Top comments (0)