Ubuntu Server 26.04: Initial Security Configuration Guide

Introduction: Configuring Ubuntu Server

After deploying a new Ubuntu server, prioritizing foundational configuration is essential for improving both security and manageability. The steps below apply to a newly installed Ubuntu Server system; Ubuntu documentation currently targets the latest LTS release, Ubuntu 26.04 LTS (according to ubuntu.com). If you are using Ubuntu 24.04 or 22.04 LTS, the basic command names in this guide remain similar.

Step 1 — Log in via SSH

You need to know the server’s public IP address and have the corresponding password or private key. Log in via SSH using the account created by the provider or installer:

ssh username@your_server_ip

SSH provides an encrypted remote control connection through OpenSSH (according to ubuntu.com).

Note about root: Ubuntu usually disables direct login with the root account by default. Instead of using root for everyday tasks, use a regular account and temporarily elevate privileges with sudo. This follows the principle of least privilege and makes administrative actions easier to audit (according to ubuntu.com).

Step 2 — Create a new user

If the system does not yet have a regular administrative account, replace sammy with the username you want to create:

sudo adduser sammy

Set a strong password. Additional information such as the full name or phone number can be left blank if not needed. On some cloud servers, the initial account is created during deployment, so you can skip this step.

Step 3 — Grant administrative privileges with sudo

Add the new user to the sudo group so they can run individual administrative commands when needed:

sudo usermod -aG sudo sammy

Log out and log back in for the session to recognize the new group. When administrative privileges are needed, place sudo before the command, for example:

sudo command_to_run

Ubuntu identifies the sudo group as the group permitted to execute commands with administrative privileges (according to ubuntu.com).

Step 4 — Configure the UFW firewall

UFW is the default firewall tool, simplifying the management of traffic-filtering rules on Ubuntu. Before enabling the firewall, allow the SSH port in use to avoid locking yourself out of remote access (according to documentation.ubuntu.com).

sudo ufw allow OpenSSH
sudo ufw enable

Enter y and then press ENTER when prompted. Check the status with:

sudo ufw status verbose

If the SSH service uses a different port, allow that port instead of using the OpenSSHprofile, for example:

sudo ufw allow 2222/tcp

Open only the ports that the application actually needs. For example, a web server typically needs HTTP and HTTPS:

sudo ufw allow http
sudo ufw allow https

You can view the available application profiles with:

sudo ufw app list

To restrict SSH to a trusted administrative IP address, use a specific rule, for example:

sudo ufw allow proto tcp from YOUR_ADMIN_IP to any port 22

Replace YOUR_ADMIN_IP with the actual IP address and verify again with sudo ufw status numbered.

Step 5 — Enable SSH for regular users

Log out of the current session or open a new terminal window, then try connecting with the new account:

ssh sammy@your_server_ip

If password authentication is enabled, the system will request the password for sammy. If using an SSH key, ensure that the public key is in /home/sammy/.ssh/authorized_keys and that the directory permissions are appropriate. Do not blindly copy the entire .ssh directory from root; distribute the correct key to the correct user and check ownership.

After logging in, check sudo privileges:

sudo whoami

The expected result is root. If the server allows multiple users, you can restrict the accounts permitted to use SSH with a dedicated group and the AllowGroups option in the OpenSSH configuration (according to ubuntu.com).

For greater security, check the SSH configuration before applying changes:

sudo sshd -t
sudo systemctl reload ssh

Disable password or root login only after confirming key-based access or ensuring that you have backup console access. An incorrect SSH configuration can lock you out of the server.

Also read: How to Install WordPress on Ubuntu with the LAMP Stack

Conclusion: Ubuntu Server Configuration

Creating a non-root account, granting controlled sudo privileges, securing access with SSH, and opening only the necessary ports with UFW are essential foundations for a secure, manageable Ubuntu server. After completing these steps, continue updating the system, monitoring logs, and deploying protections appropriate for your actual application.