On this page
A new server on the internet gets login attempts within minutes. These steps close the most common doors. They work on Ubuntu 22.04 and 24.04.
Step 1: Update everything
sudo apt update && sudo apt upgrade -yStep 2: Create your own user
Working as root all the time is risky. Create a personal user with admin rights (replace alex with your name):
sudo adduser alexsudo usermod -aG sudo alexStep 3: Log in with an SSH key instead of a password
A key is much safer than a password and can't be guessed. On your own computer (Windows PowerShell, macOS or Linux terminal), create a key:
ssh-keygen -t ed25519 -C "my-laptop"Press Enter to accept the default location and choose a passphrase. Then copy the key to your server:
# macOS / Linuxssh-copy-id alex@YOUR-SERVER-IP # Windows PowerShelltype $env:USERPROFILE\.ssh\id_ed25519.pub | ssh alex@YOUR-SERVER-IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"Now test it: ssh alex@YOUR-SERVER-IP should log you in without asking for the server password.
Step 4: Turn off password and root login
Only do this after step 3 works. Create a small settings file:
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf > /dev/null <<'EOF'PasswordAuthentication noPermitRootLogin noEOF # make sure no other file switches passwords back ongrep -ri "PasswordAuthentication" /etc/ssh/sshd_config.d/ sudo sshd -t && sudo systemctl restart sshKeep your current SSH window open and test the login in a NEW window first. If something is wrong, you can still fix it — or use the console in your ServerLoom panel.
If the grep command shows another file with PasswordAuthentication yes (for example 50-cloud-init.conf), change it to no too.
Step 5: Turn on the firewall
UFW blocks everything except what you allow. Allow SSH before enabling it:
sudo ufw allow OpenSSHsudo ufw enablesudo ufw statusRunning a website or game? Open only its port, for example sudo ufw allow 443/tcp for HTTPS or sudo ufw allow 25565/tcp for Minecraft.
Step 6: Ban attackers automatically
Fail2ban watches your login logs and blocks IPs that keep guessing. On Ubuntu it protects SSH as soon as it's installed:
sudo apt install -y fail2bansudo systemctl enable --now fail2bansudo fail2ban-client status sshdStep 7: Install security updates automatically
sudo apt install -y unattended-upgradessudo dpkg-reconfigure -plow unattended-upgradesChecklist
- System up to date and security updates automatic.
- Personal user with sudo, root login disabled.
- SSH keys only — no passwords.
- Firewall on, only the ports you need open.
- Fail2ban blocking brute-force attempts.
Every ServerLoom server also sits behind ServerLoom Shield, so DDoS attacks are filtered before they reach your firewall.
High-clock AMD Ryzen, NVMe storage, full root access and ServerLoom Shield DDoS protection — online in minutes.