My default Ubuntu 22.04 setup checklist

Every new VPS gets the same treatment before anything else goes on it. Writing it down so I stop doing it from memory and forgetting step four.

1. Create a non-root user with sudo. Disable password auth in sshd_config the moment key login works. Also PermitRootLogin no. This takes two minutes and closes the noisiest attack surface.

2. UFW, deny by default. Only open what the box actually serves:

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw enable

3. fail2ban for SSH. Defaults are fine for a personal box; I just make sure it's actually running.

4. Unattended security updates. The one I always forgot, hence this list:

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

5. Set the timezone and a hostname that means something. Future me greps logs by hostname; "vps-01" tells me nothing six months later.

That's it. Everything else — the actual services — comes after. A boring checklist, but boring is the point.

← Back to notes