Initial Server Setup on Ubuntu 22.04

After deploying a new Ubuntu 22.04 server, you should perform a few essential configuration steps before putting it into production. This guide covers creating a non-root user, configuring a basic firewall, and enabling automatic security updates.

Prerequisites

• A running Ubuntu 22.04 server
• SSH access as root

Step 1 — Update the System

Connect to your server and update all packages:

$apt update && apt upgrade -y

Hit:1 http://archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
...
Reading package lists... Done
Building dependency tree... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Step 2 — Create a Non-Root User

Running as root is a security risk. Create a regular user with sudo privileges:

$adduser deploy

Follow the prompts to set a password. Then add the user to the sudo group:

$usermod -aG sudo deploy

Step 3 — Copy SSH Key to the New User

$rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

Test the new user in a separate terminal before logging out of root:

$ssh deploy@YOUR_SERVER_IP

Step 4 — Disable Root SSH Login

Edit the SSH daemon configuration:

$nano /etc/ssh/sshd_config

Find and update these lines:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

$systemctl restart sshd

[!WARNING] Ensure you can log in as your new user with SSH key authentication before disabling root login. Otherwise you may lock yourself out.

Step 5 — Configure UFW Firewall

Install and configure UFW (Uncomplicated Firewall):

$ufw allow OpenSSH
$ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Check the status:

$ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere

Step 6 — Enable Automatic Security Updates

$apt install unattended-upgrades -y
$dpkg-reconfigure --priority=low unattended-upgrades

Select Yes when prompted to automatically download and install stable updates.

Step 7 — Set the Timezone

$timedatectl set-timezone America/New_York

Verify:

$timedatectl

               Local time: Thu 2026-04-24 10:00:00 EDT
           Universal time: Thu 2026-04-24 14:00:00 UTC
                 RTC time: Thu 2026-04-24 14:00:00
                Time zone: America/New_York (EDT, -0400)

Next Steps

Your server is now configured with basic security hardening. Continue with:

• Configure Firewall Rules
• Install Nginx Web Server
• Attach Block Storage