A Virtual Private Server (VPS) gives you control over a Linux environment without the cost of maintaining physical server hardware. You can use one to host a website, deploy an application, run automation tasks, or experiment with DevOps tools.
A fresh VPS still needs some basic setup before you deploy anything. This guide walks through connecting to an Ubuntu Server 24.04 LTS VPS, applying updates, creating a non-root administrator, setting up SSH key access, and enabling a basic firewall.
Note: Commands are intended for a typical Ubuntu cloud VPS. Your hosting provider may use a different initial username or offer additional firewall controls. Keep your provider's recovery console available.
What You'll Need
Before you begin, make sure you have:
- A VPS running Ubuntu Server 24.04 LTS.
- The server's public IP address.
- SSH access using the credentials or key supplied during provisioning.
- A terminal on your computer. Linux and macOS include SSH clients; Windows supports SSH through PowerShell.
- Access to your VPS provider's console in case you need to recover access.
This guide uses 203.0.113.10 as a placeholder IP address. Replace it with your actual VPS IP. The example belongs to a network reserved for documentation, so it will not connect to a real server (RFC 5737).
Step 1: Connect to Your VPS Using SSH
SSH (Secure Shell) lets you access your server through an encrypted connection. Connect with the username supplied by your hosting provider. For example:
ssh root@203.0.113.10
If your provider uses a different initial account, replace root with that username. To use a private key stored at a custom location, specify it explicitly:
ssh -i ~/.ssh/my-vps-key root@203.0.113.10
On your first connection, SSH may ask you to verify the server's host fingerprint. Compare it with the fingerprint supplied by your provider before accepting it. Do not accept an unexpected fingerprint change without checking it.
After connecting, check which operating system is installed:
cat /etc/os-release
Look for output identifying Ubuntu and its version, such as PRETTY_NAME="Ubuntu 24.04.x LTS". The patch version depends on the installed updates.
Step 2: Update Ubuntu Packages
Updating the package lists helps Ubuntu identify available software updates. Upgrading packages installs those updates. Run:
sudo apt update
sudo apt upgrade
Review the proposed changes and confirm when prompted. sudo also works when you are logged in as root; omit it if your initial account does not have sudo installed or configured.
You can install a few useful diagnostic tools and UFW:
sudo apt install curl git nano ufw
These provide HTTP requests, version control, text editing, and firewall management. Review the package list before confirming installation.
Keeping software updated helps address known vulnerabilities and establishes a better baseline before you expose services to the internet. Ubuntu Server includes automatic security update configuration by default on supported releases; review your server's security update settings and reboot requirements rather than assuming every update is applied immediately.
If Ubuntu reports that a reboot is required, schedule one when it is safe to interrupt your server. Check for Ubuntu's reboot marker with:
test -f /var/run/reboot-required && echo "Reboot required"
No output means that this marker was not found; it does not guarantee that no service restart is needed.
Step 3: Create a Non-Root Administrator
The root account has unrestricted administrative privileges. Using it for every routine task increases the impact of accidental commands and compromised credentials. Create a separate account named deployer:
sudo adduser deployer
Follow the prompts to set a strong, unique password. The additional profile fields are optional. Grant the account administrative privileges through Ubuntu's sudo group:
sudo usermod -aG sudo deployer
Confirm that the account belongs to the group:
id deployer
The output should include sudo among the user's groups. Numeric user and group IDs will vary.
Verify the new account
Open a second terminal on your computer and try logging in:
ssh deployer@203.0.113.10
Once connected, test administrative access:
sudo whoami
Expected output:
root
Keep your original session open while testing. Do not disable root SSH access or change SSH authentication settings until you have confirmed that the new account works and you have a recovery route.
Step 4: Set Up SSH Key Authentication
SSH keys let you authenticate without entering your account password on every connection. If you already have a key pair, you may be able to reuse it. Otherwise, create one on your local computer:
ssh-keygen -t ed25519 -C "jobot-vps"
Accept the suggested file location or choose a custom one, and protect the private key with a passphrase. The command creates two files, typically:
~/.ssh/id_ed25519— private key; never share it.~/.ssh/id_ed25519.pub— public key; install this on the server.
Copy the public key to the new account:
ssh-copy-id deployer@203.0.113.10
If you used a custom key filename, provide it with ssh-copy-id -i. Some VPS providers disable password login for the initial account. In that case, use the provider's documented method or recovery console to install the public key for deployer; do not change SSH settings until you can verify access.
Test key authentication in a fresh terminal:
ssh deployer@203.0.113.10
If everything is configured correctly, you should be able to connect using your key, potentially entering its passphrase. Keep the provider's recovery console available. SSH configuration changes can lock you out if made incorrectly.
Step 5: Configure the UFW Firewall
UFW is Ubuntu's firewall management tool. Before enabling it, allow the port your SSH server actually uses. For the default OpenSSH profile, check available profiles and add the rule:
sudo ufw app list
sudo ufw allow OpenSSH
If the profile is unavailable or SSH listens on a custom port, allow the actual port instead. For example, for TCP port 2222:
sudo ufw allow 2222/tcp
Do not enable the firewall until you have allowed the port you use for SSH. Then enable UFW and inspect its rules:
sudo ufw enable
sudo ufw status verbose
Confirm the enable prompt. A typical result for the default SSH port includes:
Status: active
22/tcp (OpenSSH) ALLOW IN Anywhere
IPv6 rules may also appear, depending on your configuration. To host a public website, you can later allow HTTP and HTTPS traffic:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
Only open ports required by services you actually use. Check your VPS provider's network firewall or security group too: provider-level rules and UFW must both permit intended traffic. See the Ubuntu UFW guide for more details.
Step 6: Verify Your Server's Health
Before deploying an application, check that the system is responding normally. View the operating system and kernel:
hostnamectl
uname -r
Check disk usage and memory:
df -h
free -h
Review services that have failed:
systemctl --failed
A healthy, uncomplicated server may report no failed units. If services are listed, investigate them rather than assuming they are harmless. Finally, check that SSH is running:
sudo systemctl status ssh
The output should generally show the SSH service as active. Press q to exit the status display.
Step 7: Establish Good Server Habits
Your server is ready for basic administration, but maintaining it securely is ongoing work. Follow these practices:
- Keep software updated. Review available updates regularly and plan reboots when required.
- Protect SSH keys. Never upload private keys to GitHub or include them in your application repository.
- Use least privilege. Use
sudoonly when administrative access is necessary. - Back up important data. Verify that your backups can actually be restored.
- Monitor disk space and service health. Logs and application data can consume storage unexpectedly.
- Expose only necessary ports. Avoid opening databases and administrative interfaces directly to the public internet without a specific, secure design.
Common Problems and Troubleshooting
SSH connection timed out: Check the server's IP, whether the VPS is running, the SSH port, and both provider-level and operating-system firewall rules.
Permission denied (publickey): Verify the username, the private key selected by your SSH client, and whether the matching public key is installed for that user.
A command returns “Permission denied”: Check whether the operation requires sudo and whether your account belongs to the appropriate group.
You cannot reconnect after enabling UFW: Use your VPS provider's recovery console if necessary. Check that your actual SSH port was allowed before making further firewall changes.
Conclusion
Setting up a Linux VPS involves more than simply logging in. By updating Ubuntu, creating a non-root administrator, testing SSH key authentication, and configuring UFW, you establish a solid foundation for hosting websites and applications.
These steps are a starting point, not a complete production security audit. Before deploying a public service, review your provider's firewall, backups, monitoring, update policy, and application-specific security requirements.
