A new Ubuntu 24.04 VPS is ready for applications only after you establish a tested administrative login, update the operating system, configure the firewall without blocking SSH, and verify automatic security updates. Start from the provider console, record the real SSH port and public IP, create a named sudo account, test it in a second session, then harden SSH and enable UFW. Ubuntu 24.04 LTS receives standard security maintenance through 31 May 2029; Ubuntu Pro can extend coverage beyond that date.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are setting up
Ubuntu 24.04 LTS, codenamed Noble Numbat, is a non-graphical server operating system intended to be administered from a shell. The initial setup is an operational baseline, not an application deployment. You are making sure that you can get in, recover access, apply updates, limit network exposure, and understand what the machine will do when maintenance runs unattended.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Ubuntu’s security guidance uses least privilege: administer the machine through a named account with sudo, and use SSH for remote access rather than sharing a permanent root login. Canonical’s documentation identifies UFW as Ubuntu’s default firewall configuration tool. The default Ubuntu Server installation also includes unattended-upgrades, which applies security updates daily.
Do not perform the steps as one blind script. The safe order matters: preserve a recovery path, test each new login, and only then change the setting that could cut off your current connection.
#1 Best Overall
Before the first login: collect the facts
Open the hosting provider’s console or dashboard and record the details below. Provider images differ, so assumptions copied from an older tutorial can be dangerous.
| Item | What to record | Why it matters |
|---|---|---|
| Operating-system image | Ubuntu 24.04 LTS (Noble Numbat), not an older release or a custom derivative | Package paths, defaults, and maintenance dates depend on the release. |
| Public address | IPv4 address and, if supplied, IPv6 address | You need the correct destination for SSH and a way to check both protocol families later. |
| Initial account | The provider-created username and whether it starts as root | Some images forbid root SSH even when the provider console permits it. |
| SSH port | The actual listening port, which may not be 22 | UFW must allow the port you really use before it is enabled. |
| Authentication method | Injected public key, temporary password, or console-only access | The method determines how you create and test a permanent administrator. |
| Recovery console | Out-of-band console, rescue mode, or serial access | Keep this path available in case an SSH or firewall change fails. |
| Snapshots and backups | What is included, retention, and how restoration is initiated | A VPS snapshot is a recovery control, not a substitute for a tested backup policy. |
Ubuntu Server’s official 24.04 image is command-line only. Expect to work in a terminal; a desktop interface is neither installed nor required for normal administration.
First login and a quick inventory
Connect using the provider’s supplied account and the recorded port. The address 203.0.113.10 below is documentation-only; substitute the address assigned to your VPS.
ssh -p 22 [email protected]If the provider says the SSH port is 2200, use -p 2200 consistently in every test and firewall rule. Once connected, establish basic facts before changing configuration.
hostnamectl
whoami
id
cat /etc/os-release
ip -brief address
ss -tulpnhostnamectl shows the host name, cat /etc/os-release confirms the release, and ss -tulpn lists listening TCP and UDP sockets. Unexpected listeners are worth investigating before you expose the server to the internet.
Check whether the firewall command is already available:
command -v ufw
sudo ufw status verboseSome provider images include UFW; others do not. Ubuntu 24.04 release notes specifically warn that images supplied through Oracle Cloud may omit it, so treat an absent command as a normal variation rather than evidence that the server is unprotected.
Update the operating system before installing applications
Apply the current package metadata and upgrades before you install a web server, database, runtime, or control panel. Ubuntu’s security guidance recommends this order.
sudo apt update
sudo apt upgradeRead the transaction summary. If the command proposes removing packages you expected to keep, stop and investigate rather than accepting blindly. A large kernel or library update can make a reboot necessary; a reboot is not required after every upgrade.
Use the package manager’s or needrestart’s indication to decide whether to reboot:
sudo needrestartOn Ubuntu 24.04, needrestart can automatically restart affected services after unattended upgrades. On a production VPS, that behavior can interrupt a service even when the machine itself does not reboot. Record the restart policy for each application and schedule maintenance when a restart would affect traffic.
If a reboot is required, confirm that you have a recovery-console path and that your new administrative account will work afterward. Then reboot during an appropriate window:
sudo rebootReconnect after the provider reports that the instance is running. Do not start application installation until the update transaction has completed and the machine is reachable again.
Create a named administrator with least privilege
Do not use a shared root credential as your normal identity. Create an account tied to one person or operational role, give it the administrative group, and authenticate it with an SSH key.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add the account
sudo adduser alice
sudo usermod -aG sudo aliceReplace alice with the account name you chose. adduser asks for a password and optional profile fields. The account does not need to be called your real name, but it should identify its owner in your access records.
Install the public key
From your workstation, the simplest method is ssh-copy-id while the provider account still works:
ssh-copy-id -p 22 [email protected]If the provider account cannot write another user’s home directory, use the provider console or a root-capable session to create /home/alice/.ssh/authorized_keys. The directory should be private and owned by the new account:
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
sudo chown alice:alice /home/alice/.ssh/authorized_keys
sudo chmod 600 /home/alice/.ssh/authorized_keysPut your complete public key on one line in authorized_keys. Never copy a private key to the VPS. If you have more than one administrator, give each person a separate key so one person’s departure does not require replacing everybody else’s access.
Recommended Free Tools
Test a separate session before hardening
Leave the original session open. Open a second terminal and log in as the named account:
ssh -p 22 [email protected]
sudo -v
sudo whoamiThe final command should print root. This proves both key authentication and the intended sudo policy. Also test that the account can read its home directory and run a harmless command after reconnecting, not merely in the original shell.
Harden SSH without locking yourself out
Only change SSH policy after the separate login test succeeds. Keep the provider console available until you have disconnected and reconnected successfully with the final settings.
Review the effective SSH configuration
Ubuntu reads the main daemon configuration from /etc/ssh/sshd_config and may also process included files. Inspect the current settings before editing:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo sshd -T | grep -E '^(port|permitrootlogin|passwordauthentication|pubkeyauthentication) 'The effective output is more useful than guessing which file supplied a value. Confirm the listening port, whether public-key authentication is enabled, and whether root or password login is currently permitted.
Disable direct root and password login only when keys work
Edit the appropriate SSH configuration file with your preferred editor. The commonly used policy is:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesDo not apply PasswordAuthentication no until every required administrator has a working key. If a provider relies on password recovery or a special automation account, document that dependency before removing it. A named sudo account gives you administrative capability without exposing a direct root login.
Validate and reload
Check syntax before asking the daemon to reload:
sudo sshd -t
sudo systemctl reload sshA successful sshd -t produces no output. If it reports an error, fix the configuration and run the test again; do not reload a file that has not passed validation. Now start a new SSH connection from another terminal using the named account and the actual port. Only after that connection works should you close the original provider session.
Install and enable UFW safely
UFW is Ubuntu’s default firewall configuration tool. Its job is to make inbound policy explicit, but an incorrect rule can immediately remove your access. The safe sequence is: install if necessary, allow the real SSH port, add application ports, review, and then enable.
Install it when the image does not include it
sudo apt update
sudo apt install ufwIf command -v ufw already returned a path, skip installation. Installing the package does not by itself enable the firewall.
Allow SSH before enabling the firewall
For a server that truly listens on port 22, the rule is:
sudo ufw allow 22/tcpIf your SSH daemon listens on 2200, allow that port instead:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo ufw allow 2200/tcpAllowing port 22 when SSH actually uses 2200 does not protect your session. Confirm the port with sshd -T or the listening-socket list.
Add only ports required by the application
A public web server commonly needs HTTP and HTTPS, but do not open them merely because they are familiar ports. Add a rule when you have installed a service that needs it:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpDatabase, cache, administration, and internal application ports should remain closed to the public internet unless your design explicitly requires remote access. Prefer an application’s private network or a restricted source range when the provider and application support it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsReview, enable, and verify
sudo ufw status numbered
sudo ufw enable
sudo ufw status verboseWhen UFW asks for confirmation, proceed only after the SSH rule shown is the one you need. Keep the current session open and test a new SSH session immediately. To remove an erroneous rule, use its number from the numbered listing:
sudo ufw delete 2UFW controls the host firewall; a provider’s network firewall or security-group layer may still block traffic before it reaches the VPS. Check both layers when a port appears open locally but is unreachable externally.
Verify automatic security updates
Ubuntu Server installs unattended-upgrades by default and applies security updates on a daily cadence. “Automatic” does not mean “unreviewed”: you should confirm the package, timers, policy, logs, and service-restart behavior.
Confirm the package and timers
dpkg -s unattended-upgrades | grep -E '^(Status|Version):'
systemctl list-timers --all apt-daily.timer apt-daily-upgrade.timerThe timers show when package metadata and unattended upgrades are scheduled. A timer can be enabled even when the latest run failed, so inspect the logs as well.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Inspect the policy files
sudo sed -n '1,160p' /etc/apt/apt.conf.d/20auto-upgrades
sudo sed -n '1,240p' /etc/apt/apt.conf.d/50unattended-upgradesThe default policy covers official Ubuntu archive repositories. Packages from third-party repositories are not automatically covered simply because unattended-upgrades is installed; those repositories require explicit policy and a separate risk review.
Read the run history
sudo ls -l /var/log/unattended-upgrades
sudo less /var/log/unattended-upgrades/unattended-upgrades.log
sudo less /var/log/unattended-upgrades/unattended-upgrades-dpkg.logLook for successful package installation, held packages, signature errors, or a transaction that stopped midway. Keep enough disk space for package caches and logs so a full filesystem does not prevent future updates.
Plan for restarts
Ubuntu 24.04’s needrestart integration can restart services affected by updates. That is useful for applying security fixes promptly, but it is an availability event. For production, identify which services may restart, monitor them after a maintenance run, and arrange a change window if a restart could interrupt requests.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Understand the Ubuntu 24.04 APT layout
Ubuntu 24.04 stores the main Ubuntu archive definitions in deb822 format at /etc/apt/sources.list.d/ubuntu.sources. Many older tutorials tell you to edit /etc/apt/sources.list; copying those instructions unchanged can leave you auditing or replacing the wrong file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Audit the active sources
sudo sed -n '1,240p' /etc/apt/sources.list.d/ubuntu.sources
grep -R --line-number --include='*.sources' --include='*.list' '^Types:|^deb ' /etc/apt/sources.list.d /etc/apt/sources.list 2>/dev/nullBefore adding a repository, verify its signing instructions, release support, and necessity. Keep third-party entries separate and identifiable so you can disable one without altering the Ubuntu archive definition. Run sudo apt update after any change and treat signature or release-file errors as a configuration problem to solve, not a warning to ignore.
Run a post-setup baseline check
After SSH and UFW changes, capture a baseline while the system is still simple. Repeat the relevant checks whenever you install a network-facing service.
- Identity and time: run
hostnamectlandtimedatectl; confirm the hostname and clock are sensible. - Capacity: run
df -handfree -h; leave headroom for package caches, logs, and application data. - Listeners: run
ss -tulpn; investigate every public listener you did not intentionally deploy. - Firewall: run
sudo ufw status numberedand compare the rules with the ports your application actually needs. - SSH: open a new session with the named account and key, then run
sudo -v. - Updates: run
apt list --upgradableand review the unattended-upgrade log. - Recovery: open the provider console or document the exact recovery procedure, without terminating your working SSH session.
Record the baseline in your operations notes, including the SSH port, account names, firewall rules, source files changed, and the date of the last successful console and SSH tests.
Choose an operating policy, not just a VPS image
Two VPSs with identical CPU and memory can have very different operational risk. Evaluate the service around the virtual machine as well as the Ubuntu image.
| Decision area | Questions to answer before deployment |
|---|---|
| Image contents | Is it an official Ubuntu 24.04 LTS image? Is UFW present? Are provider agents or preinstalled services listening? |
| Access defaults | Is SSH-key authentication available from the start? Is root login enabled, disabled, or limited to the console? |
| Network controls | Is there a provider firewall in addition to UFW? Can you restrict IPv4 and IPv6 independently? |
| Update behavior | Are security updates automatic? Which repositories are covered? Can services restart automatically, and where are logs? |
| Recovery | Is there a reliable console, rescue image, snapshot, and documented restore process? |
| Operations | Are backups, monitoring, alerts, reverse-DNS controls, and both IPv4 and IPv6 available at the level your application needs? |
These choices affect how you respond to a lockout, a failed update, a full disk, or an unexpected service restart. Document the answers before production traffic arrives.
Troubleshoot the common first-day failures
SSH times out
Check the VPS power state and public address first. Then verify that the provider firewall allows the recorded port, UFW allows the same port, and ss -tulpn shows an SSH listener. A timeout usually indicates routing or filtering; it is different from a rejected connection.
SSH says “Permission denied”
Confirm that you are using the correct account and port. From the console, check ownership and modes for /home/alice/.ssh and authorized_keys, and verify that the public key is one line with no accidental wrapping. Do not disable key authentication to work around a malformed key.
You enabled UFW and lost access
Use the provider’s out-of-band console, run sudo ufw status numbered, and add the actual SSH port. If necessary, disable UFW temporarily from the console with sudo ufw disable, correct the rule, and enable it again. Do not close the console session until a new external SSH connection succeeds.
APT reports that another process holds the lock
Wait for apt-daily or unattended-upgrades to finish and inspect the relevant system logs. Killing package processes or deleting lock files can leave the package database inconsistent. Retry the command after the scheduled job exits, then run sudo dpkg --configure -a only if the package manager reports an interrupted transaction.
A service restarted after an update
Check the unattended-upgrade and system journal entries, then verify the service’s health and listening socket. This is expected for packages affected by Ubuntu 24.04’s needrestart behavior; treat it as a maintenance event and adjust your deployment window or service supervision if the interruption is unacceptable.
APT cannot find a package after a repository edit
Inspect /etc/apt/sources.list.d/ubuntu.sources and any additional .sources or .list files, then run sudo apt update. Check that the distribution suite matches Ubuntu 24.04 and that repository signatures validate. Do not replace the deb822 file with a copied pre-24.04 tutorial fragment.
When the baseline is complete
Your VPS is ready for application-specific work when a named account can authenticate with a key, sudo works, direct root and password SSH access are disabled only where appropriate, UFW allows exactly the required ports, updates have completed, automatic-update logs are readable, and the provider recovery path has been tested. Keep the maintenance date in your calendar: Ubuntu 24.04 LTS has standard security maintenance through 31 May 2029, after which continued coverage requires an extended-support arrangement such as Ubuntu Pro.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
