After provisioning a new Ubuntu server on Data Mammoth, there are several essential configuration steps you should complete before deploying any applications. This guide walks you through initial security hardening, user setup, firewall configuration, and system updates on Ubuntu 22.04 or 24.04.

Prerequisites

Before starting, you will need:

• A newly provisioned Data Mammoth Ubuntu 22.04 or 24.04 server.
• The root password (from your provisioning email or dashboard) or an SSH key configured during setup.
• An SSH client on your local machine (Terminal on macOS/Linux, PowerShell or PuTTY on Windows).

Step 1 — Connect to Your Server

Connect to your server via SSH as the root user:

ssh [email protected]

If this is your first connection, you will see a fingerprint verification prompt. Type yes to continue.

If you set up an SSH key during provisioning, you will be logged in automatically. Otherwise, enter the root password provided during setup.

Step 2 — Update the System

Start by updating all installed packages to their latest versions:

apt update && apt upgrade -y

This ensures you have the latest security patches and bug fixes. If a kernel update is installed, you may be prompted to restart. You can do so at the end of the setup process.

Step 3 — Create a Non-Root User

Running everything as root is a security risk. Create a regular user with sudo privileges:

adduser deploy

Follow the prompts to set a password and fill in optional information. Then grant the user sudo access:

usermod -aG sudo deploy

The user deploy can now run administrative commands with sudo.

Step 4 — Set Up SSH Key Authentication for the New User

Copy your SSH public key to the new user's account:

# From your local machine
ssh-copy-id [email protected]

Or manually set it up on the server:

# As root on the server
su - deploy
mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste your public key, save the file, and set permissions:

chmod 600 ~/.ssh/authorized_keys
exit

Test the connection by logging in as the new user from your local machine:

ssh [email protected]

Step 5 — Harden SSH Configuration

Once SSH key authentication is working for your new user, secure the SSH daemon:

sudo nano /etc/ssh/sshd_config

Change or add the following settings:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 5
LoginGraceTime 60

Save the file and restart SSH:

sudo systemctl restart sshd

Important: Before closing your current session, open a new terminal and verify you can log in as your new user. If you lock yourself out, use the web console to fix the configuration.

Step 6 — Configure the Firewall (UFW)

Ubuntu includes UFW (Uncomplicated Firewall) by default. Set it up to allow only necessary traffic:

# Allow SSH connections
sudo ufw allow OpenSSH
Enable the firewall
sudo ufw enable
Check the status
sudo ufw status verbose

If you plan to run a web server, also allow HTTP and HTTPS:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

For more advanced firewall configuration, see Server Firewall Hardening Guide.

Step 7 — Set the Hostname

Set a meaningful hostname for your server:

sudo hostnamectl set-hostname web01.example.com

Update /etc/hosts:

sudo nano /etc/hosts

Add a line mapping your hostname:

127.0.1.1   web01.example.com web01

See Changing Your Server Hostname for more details.

Step 8 — Configure the Timezone

Set the correct timezone for your region:

# List available timezones
timedatectl list-timezones
Set your timezone
sudo timedatectl set-timezone America/New_York
Verify
timedatectl

Step 9 — Enable Automatic Security Updates

Configure Ubuntu to automatically install security updates:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Select Yes when prompted. This ensures critical security patches are applied automatically without manual intervention.

Step 10 — Install Essential Tools

Install commonly needed utilities:

sudo apt install -y \
  curl \
  wget \
  git \
  htop \
  net-tools \
  ufw \
  fail2ban \
  software-properties-common

Configure Fail2ban

Fail2ban protects against brute-force attacks by banning IPs that show suspicious login activity:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Create a local configuration:

sudo nano /etc/fail2ban/jail.local

Add the following:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600

Restart Fail2ban:

sudo systemctl restart fail2ban

Step 11 — Reboot (if needed)

If kernel updates were installed in Step 2, reboot now:

sudo reboot

After rebooting, log in as your new user:

ssh [email protected]

Post-Setup Verification Checklist

After completing the setup, verify everything is configured correctly:

• [ ] System packages are up to date: sudo apt update && apt list --upgradable
• [ ] Non-root user can log in via SSH key: ssh [email protected]
• [ ] Root login is disabled: verify in /etc/ssh/sshd_config
• [ ] Firewall is active: sudo ufw status
• [ ] Hostname is set: hostname -f
• [ ] Timezone is correct: timedatectl
• [ ] Fail2ban is running: sudo systemctl status fail2ban

What to Do Next

• Installing LAMP Stack on Your VPS — Set up Apache, MySQL, and PHP.
• Installing Docker & Docker Compose — Containerize your applications.
• SSH Key Best Practices — Strengthen your SSH security.
• Complete Server Security Checklist — Full security hardening guide.