You just got root on a fresh Ubuntu box. That is power and risk in the same login. Attackers scan new IPs within minutes. This walkthrough hardens a typical Ubuntu 22.04 or 24.04 VPS in about a quarter of an hour. It works on any honest provider. If you use Pro Gineous, the steps are the same.

Assumptions: you can SSH in as root (or with sudo), you have a second terminal ready, and you are okay restarting SSH carefully.

Minutes 0-3: update and create a user 

apt update && apt upgrade -y adduser deploy usermod -aG sudo deploy

Use a real password for deploy even if you plan to disable password SSH later. Keep the root session open until key login works.

Minutes 3-6: SSH keys only

On your laptop:

ssh-copy-id deploy@YOUR_SERVER_IP

Confirm you can open a second SSH session as deploy before you change sshd. Then edit /etc/ssh/sshd_config (or a drop-in under /etc/ssh/sshd_config.d/):

PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes

Reload SSH (name varies by release):

sudo systemctl reload ssh || sudo systemctl reload sshd

If the second session still works, you are safe. Only then close the root session.

Minutes 6-8: firewall 

ufw default deny incoming ufw default allow outgoing ufw allow OpenSSH ufw allow 80/tcp ufw allow 443/tcp ufw enable ufw status verbose

If you use a non-default SSH port, allow that port instead of OpenSSH.

Minutes 8-10: fail2ban 

apt install -y fail2ban systemctl enable --now fail2ban

Default jails already watch SSH on many Ubuntu images. Check:

fail2ban-client status fail2ban-client status sshd

If sshd is missing, add a simple jail under /etc/fail2ban/jail.d/sshd.local:

[sshd] enabled = true

Then systemctl restart fail2ban.

Minutes 10-12: automatic security updates 

apt install -y unattended-upgrades dpkg-reconfigure -plow unattended-upgrades

Confirm it is active:

systemctl status unattended-upgrades --no-pager

Minutes 12-14: timezone, swap, noise 

timedatectl set-timezone UTC # or your region ss -tulpn

Close ports and services you do not need. On a 1-2 GB box with no swap:

fallocate -l 1G /swapfile chmod 600 /swapfile mkswap /swapfile swapon /swapfile echo '/swapfile none swap sw 0 0' >> /etc/fstab

Skip swap if your provider already gives you enough RAM or managed swap.

Minutes 14-15: snapshot and backups

  1. Take a provider snapshot now, while the box is clean and hardened.
  2. Schedule off-server backups for anything that will hold real data (database dumps, /var/www, secrets). A snapshot is not a tested restore.
  3. Write down where backups live and how you would restore them.

What this does not cover

  • Application security (WordPress plugins, dependency CVEs, auth bugs)
  • Secrets management (API keys in git, world-readable .env files)
  • Monitoring and alerting
  • DDoS or network-layer attacks beyond a basic firewall

Those are next layers. This checklist only makes a fresh VPS less of an open door.

Closing

Own the server, own the failure modes. Fifteen minutes of boring hygiene beats a weekend of incident cleanup.

I run Pro Gineous, a hosting company. Our VPS plans start at $6.99/mo. Use any provider you trust. Just own your domain, keep SSH locked down, and test a restore once.