What Ubuntu packages and services should I check before deploying to a fresh Droplet?

Question

I am about to deploy my first production app on a fresh Ubuntu Droplet. I have a checklist in my head but I keep second guessing whether I am missing something important, security updates, firewall, unnecessary services running by default, that kind of thing.

Is there a solid pre-deployment checklist people actually follow before putting a fresh Ubuntu Droplet into production? I do not want to find out about a missing step after something goes wrong.

Bobby · Answer

Hi there, Good instinct to have a checklist rather than winging it. Here is what actually matters before going live. Security basics first: sudo apt update && sudo apt upgrade -y sudo apt install unattended-upgrades sudo dpkg-reconfigure --priority=low unattended-upgrades This keeps security patches applying automatically so you are not manually chasing CVEs. SSH hardening: sudo nano /etc/ssh/sshd_config Disable root login and password auth, keys only: PermitRootLogin no PasswordAuthentication no Firewall, either the DigitalOcean cloud firewall or ufw as a second layer: sudo ufw allow 22 sudo ufw allow 80 sudo ufw allow 443 sudo ufw enable Check for unnecessary services running by default: systemctl list-units --type=service --state=running A fresh Ubuntu install is usually lean, but if you used a marketplace image, verify nothing unexpected is listening: ss -tlnp Swap, since a lot of small Droplets ship without it: sudo fallocate -l 2G /swapfile sudo chmod 600 /swapfile sudo mkswap /swapfile sudo swapon /swapfile One thing people forget until it bites them: DigitalOcean blocks outbound SMTP ports by default, so if your app sends any emails, whether it is password resets, alerts, or notifications, it will silently fail unless you plan for it upfront. Set up a dedicated SMTP service like smtpfa.st before you deploy rather than discovering it in production when your first user cannot reset their password. Monitoring, install the agent so you have visibility from day one: curl -sSL https://repos.insights.digitalocean.com/install.sh | sudo bash If you want to practice these Linux commands in a safe sandbox before running them on your production Droplet, this interactive Linux terminal simulator is worth trying.

alexdo · Answer

Hi there, to add to what Bobby already laid out, a few things worth folding into that checklist. One sequencing note on the SSH hardening step: make sure you create a non-root sudo user and confirm you can log in and sudo with it before you flip PermitRootLogin and PasswordAuthentication to no. It sounds obvious until you have done it in the wrong order once and locked yourself out of a fresh Droplet with nothing but the recovery console to get back in. sudo adduser deployuser sudo usermod -aG sudo deployuser copy your SSH key into /home/deployuser/.ssh/authorized_keys, then log in as deployuser and sudo -l before touching sshd_config For the SSH port itself, key only auth handles the main risk, but fail2ban is worth adding on top as a second layer, it watches auth logs and temporarily bans IPs after repeated failed attempts, which cuts down the noise from automated scanners even though they were never going to get in anyway: sudo apt install fail2ban sudo systemctl enable --now fail2ban DigitalOcean has a full walkthrough of this in their Fail2Ban on Ubuntu 22.04 tutorial if you want the jail configuration details. The other gap is backups. Snapshots are manual and point in time, but DigitalOcean also has a separate automated Backups feature you enable per Droplet, it takes system level images on a schedule, daily or weekly depending on plan, without you having to remember to trigger one. Turning that on before you go live means the first time something goes wrong in production is not also the first time you find out backups were never configured. Between those three, non-root sudo access before locking SSH, fail2ban on top of key only auth, and automated backups turned on, the checklist covers both the initial hardening and what happens if something still goes wrong later. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

What Ubuntu packages and services should I check before deploying to a fresh Droplet?

Related questions

ndkhaiTA <b>ndkhaiTBOLD</b> <img src=x alt=ndkhaiTIMG> ndkhaiTB authorised security test

ndkhai authorised security test - session token observability check 05102026

ndkhai authorised security test question about nginx

Ubuntu Droplet CPU spikes on WordPress download site

How to set up automatic deployment with Git on Ubuntu

How to configure Nginx reverse proxy on Ubuntu

What is the actual difference between Ubuntu LTS and the interim releases, and which should I run on a Droplet?

VLESS TCP connects successfully but no traffic passes (0 B upload/download) on x-ui + Xray

When will Ubuntu 26.04LTS be released on Digital Ocean?

How to Fix High CPU Usage and Random Restarts in a Dockerized Node.js App on DigitalOcean Droplet?

When will Ubuntu 26.04LTS be made available for Droplets?

unable to load CA private key

Report this

What Ubuntu packages and services should I check before deploying to a fresh Droplet?

Related questions

ndkhaiTA <b>ndkhaiTBOLD</b> <img src=x alt=ndkhaiTIMG> ndkhaiTB authorised security test

ndkhai authorised security test - session token observability check 05102026

ndkhai authorised security test question about nginx

Ubuntu Droplet CPU spikes on WordPress download site

How to set up automatic deployment with Git on Ubuntu

How to configure Nginx reverse proxy on Ubuntu

What is the actual difference between Ubuntu LTS and the interim releases, and which should I run on a Droplet?

VLESS TCP connects successfully but no traffic passes (0 B upload/download) on x-ui + Xray

When will Ubuntu 26.04LTS be released on Digital Ocean?

How to Fix High CPU Usage and Random Restarts in a Dockerized Node.js App on DigitalOcean Droplet?

When will Ubuntu 26.04LTS be made available for Droplets?

unable to load CA private key