Securing your fresh Ubuntu 24.04 VPS in 10 minutes (UFW, SSH keys, Fail2Ban)

A new Ubuntu server on Joy is reachable from the whole internet within a minute of boot, and password-guessing bots find it within the hour. Ten minutes of work closes the obvious doors. Everything below is copy-paste safe on Ubuntu 24.04 and 22.04.

1. Update

apt update && apt upgrade -y && reboot

2. SSH keys, no passwords

# from your computer
ssh-copy-id root@YOUR_IP
# on the server, after confirming key login works in a NEW terminal
printf 'PasswordAuthentication no\nPermitRootLogin prohibit-password\n' > /etc/ssh/sshd_config.d/50-joy.conf
sshd -t && systemctl restart ssh

3. A non-root user with sudo

adduser deploy && usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

4. Firewall

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw default deny incoming
ufw enable

5. Automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

6. Fail2Ban

apt install fail2ban -y
cat > /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
maxretry = 5
bantime = 1h
EOF
systemctl enable --now fail2ban
fail2ban-client status sshd

7. Time, swap and a snapshot

timedatectl set-timezone Asia/Kolkata     # or your zone
# 1–2 GB servers: add swap so MySQL does not get OOM-killed
fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

Finally, take a snapshot from the server page so you can roll back after experiments. That is the baseline; the firewall guide and SSH keys guide go deeper.