Initial Server Setup with Ubuntu

When you first create a new Ubuntu server, you should perform some important configuration steps as part of the initial setup. These steps will increase the security and usability of your server and will give you a solid foundation for subsequent actions.

This tutorial has been validated on Ubuntu 22.04 LTS, 24.04 LTS, and 24.10. The commands use default packages that remain stable across current interim releases and upcoming 25.x builds that ship with apt, OpenSSH, and UFW defaults.

• Log in as root: Learn how to securely access your Ubuntu server for the first time.
• Create a non-root user: Add a regular user account with sudo privileges to minimize security risks of daily root usage.
• Set up SSH key authentication: Configure SSH keys for secure, passwordless logins, and copy your public key to the new user.
• Configure the firewall with UFW: Enable and test the Uncomplicated Firewall (UFW) to restrict access, making sure to keep SSH open to prevent lockout.
• Validate access before exiting root: Confirm that your new user can use sudo and connect via SSH before closing the root session to avoid being locked out.
• Best practices apply to multiple environments: These initial steps apply to cloud VMs, Droplets, VPS, and bare metal servers.

Initial Server Setup with Ubuntu

1. Logging in as root
2. Creating a New User
3. Granting Administrative Privileges
4. Setting Up a Firewall
5. Enabling External Access for Your Regular User

To log into your server, you will need to know your server’s public IP address. You will also need the password or the private key for the root user’s account if you installed an SSH key for authentication. If you have not already logged into your server, you may want to follow our guide on how to Connect to Droplets with SSH, which covers this process in detail.

If you are not connected to your server currently, log in as the root user using the following command. Substitute the highlighted your_server_ip portion of the command with your server’s public IP address:

ssh root@your_server_ip

Accept the warning about host authenticity if it appears. If your server uses password authentication, provide your root password to log in. If you use an SSH key that is passphrase protected, you may need to enter the passphrase the first time you use the key each session. If this is your first time logging into the server with a password, you may also need to change the root password. Follow the instructions to change the password if you receive a prompt.

About root

The root user is the administrative user in a Linux environment with elevated privileges. Because of the heightened privileges of the root account, you are discouraged from using it regularly. The root account can make very destructive changes, even by accident.

The next step is setting up a new user account with reduced privileges for day-to-day use. Later, we’ll show you how to temporarily gain increased privileges for the times when you need them.

Once you log in as root, you’ll be able to add the new user account. In the future, we’ll log in with this new account instead of root.

This example creates a new user called sammy, but you should replace that with a username that you like:

adduser sammy

You will be asked a few questions, starting with the account password.

Enter a strong password and, optionally, fill in any additional information you would like. This information is not required, and you can press ENTER in any field you wish to skip.

Now you have a new user account with regular account privileges. However, you will sometimes need to perform administrative tasks as the root user.

To avoid logging out of your regular user and logging back in as the root account, you can set up what is known as superuser or root privileges for your user’s regular account. These privileges will allow your normal user to run commands with administrative privileges by putting the word sudo before the command.

To add these privileges to your new user, you will need to add the user to the sudo system group. By default on Ubuntu, users who are members of the sudo group are allowed to use the sudo command.

As root, run this command to add your new user to the sudo group (substitute the highlighted sammy username with your new user):

usermod -aG sudo sammy

You can now type sudo before commands to run them with superuser privileges when logged in as your regular user.

Ubuntu servers can use the UFW firewall to ensure only connections to certain services are allowed. You can set up a basic firewall using this application.

Applications can register their profiles with UFW upon installation. These profiles allow UFW to manage these applications by name. OpenSSH, the service that allows you to connect to your server, has a profile registered with UFW.

You can examine the list of installed UFW profiles by typing:

ufw app list

Output
Available applications:
  OpenSSH

You will need to make sure that the firewall allows SSH connections so that you can log into your server next time. Allow these connections by typing:

ufw allow OpenSSH

Now enable the firewall by typing:

ufw enable

Type y and press ENTER to proceed. You can see that SSH connections are still allowed by typing:

ufw status

Output
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)

The firewall is currently blocking all connections except for SSH. If you install and configure additional services, you will need to adjust the firewall settings to allow the new traffic into your server. You can learn some common UFW operations in our UFW Essentials guide.

To add HTTP access later, allow only the services you need:

ufw allow 80/tcp
ufw allow 443/tcp

Refer to How to Set Up a Firewall with UFW on Ubuntu for common patterns like rate limiting and service-specific rules.

Now that you have a regular user for daily use, you will need to make sure that you can SSH into the account directly.

Configuring SSH access for your new user depends on whether your server’s root account uses a password or SSH keys for authentication.

If the root Account Uses Password Authentication

If you logged in to your root account using a password then password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:

ssh sammy@your_server_ip

After entering your regular user’s password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

sudo command_to_run

You will receive a prompt for your regular user’s password when using sudo for the first time each session (and periodically afterward).

To enhance your server’s security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Ubuntu to learn how to configure key-based authentication.

If the root Account Uses SSH Key Authentication

If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. To log in as your regular user with an SSH key, you must add a copy of your local public key to your new user’s ~/.ssh/authorized_keys file.

Since your public key is already in the root account’s ~/.ssh/authorized_keys file on the server, you can copy that file and directory structure to your new user account using your current session.

The simplest way to copy the files with the correct ownership and permissions is with the rsync command. This command will copy the root user’s .ssh directory, preserve the permissions, and modify the file owners, all in a single command. Make sure to change the highlighted portions of the command below to match your regular user’s name:

rsync --archive --chown=sammy:sammy ~/.ssh /home/sammy

Now, open up a new terminal session on your local machine, and use SSH with your new username:

ssh sammy@your_server_ip

You should be connected to your server with the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo before the command like this:

sudo command_to_run

You will be prompted for your regular user’s password when using sudo for the first time each session (and periodically afterward).

1. Can Ubuntu be used as a server?

Absolutely. Ubuntu is one of the most popular operating systems for servers worldwide and is designed for a wide range of scenarios, from lightweight VPS instances to enterprise-grade clusters.

Key advantages of Ubuntu Server:

Sample server tasks Ubuntu handles well:

• Web hosting (Apache, Nginx)
• Databases (PostgreSQL, MySQL, MongoDB)
• Application servers (Node.js, Python, Java)
• Container orchestration (Docker, Kubernetes)
• File storage & backups

Example: To check your Ubuntu version:

lsb_release -a
# OR
cat /etc/os-release

For more on SSH and package management, see: OpenSSH Key Guide.

2. Is Ubuntu Server free?

Yes. Ubuntu Server is completely free to download, install, and use for any purpose—personal, educational, or commercial. There are no licensing costs or subscription fees.

If you’re looking for a simple and reliable way to get started, consider deploying an Ubuntu Droplet on DigitalOcean. DigitalOcean provides pre-configured Ubuntu server images so you can launch secure, production-ready servers in just a few clicks—perfect for both beginners and experts.

3. Which Ubuntu version should I pick for a new server?

Recommendation:
Use a Long Term Support (LTS) release. LTS versions are production-ready and receive updates for five years.

Popular LTS versions:

Check your current version:

lsb_release -cs   # Shows the codename (e.g., 'jammy' for 22.04)

This guide and its commands are validated for both 24.04 LTS and 22.04 LTS.

4. Should I disable password authentication for SSH?

Yes, for strong security.
Once you’ve set up SSH key authentication and confirmed you can log in, disabling password authentication for SSH reduces your server’s exposure to brute-force attacks.

Steps:

1. Open the SSH config:

   sudo nano /etc/ssh/sshd_config
   

2. Find and set:

   PasswordAuthentication no
   

3. Restart SSH:

   sudo systemctl reload sshd
   

5. Do I need to change the default SSH port?

Changing the SSH port from 22 is optional and not a substitute for proper SSH key authentication or firewall configuration.

Pros & Cons:

If you change the port:

1. Edit /etc/ssh/sshd_config:

   Port 2277   # Example port; use a port >1024 that's not in use
   

2. Update UFW rules:

   sudo ufw allow 2277/tcp
   

3. Connect using:

   ssh -p 2277 user@your_server_ip
   

4. Document your new port to avoid lockout.

Use it as an extra step, not your primary defense.

Congratulations! You have completed the essential initial server setup process with Ubuntu. By following these steps, you’ve greatly improved your server’s security and laid the groundwork for future configuration. You now have a non-root user account with sudo privileges for safer daily administration, a firewall (UFW) configured to restrict all traffic except what you explicitly allow, and secure SSH key authentication in place—significantly reducing your risk of unauthorized access.

With these best practices in place, your Ubuntu server is ready for web hosting and application deployment, and any further customization you need. The setup completed in this tutorial is a baseline requirement for nearly every Linux server project, and understanding these fundamentals will help you confidently manage infrastructure in the cloud or on-premises.

Remember to keep track of your new credentials, maintain regular updates, and continue learning to keep your systems secure and maintainable.

At this point, you have a solid foundation for your server. You can install any of the software you need on your server now.

If you’d like to get more familiar with Linux commands, you can check our Linux Command Line Primer.

Looking for next steps on SSH and firewall hardening? Review SSH Essentials: Working with SSH Servers, Clients, and Keys, How To Use SSH to Connect to a Remote Server, and Understanding the SSH Encryption and Connection Process.

Try this next: Create a DigitalOcean Droplet with Ubuntu 24.04 LTS, apply these steps, then add a managed database or deploy via App Platform. Explore DigitalOcean’s Ubuntu distribution page for current images and release notes.