How to Lock Down Your Ubuntu 24 Server: A Beginner’s Guide

So, you just spun up a brand new Ubuntu 24 server. You may find a lot of SSH brute force logins failures.

We need to lock that door. In this guide, I’m going to show you exactly how to secure your server so the bad guys stay out and your data stays safe. We will create a new user, stop the root user from logging in, and set up a “bouncer” (Fail2Ban) to kick out anyone trying to brute-force their way in.

---

Step 1: Create a New User

By default, you probably log in as root. The root user is the “superuser”—it can do absolutely anything. That sounds cool, but it’s dangerous. If a hacker guesses your root password, they own everything.

We need to create a regular user that we use for daily tasks. We will give this user “sudo” powers, which means they can borrow root powers only when they need to.

1. Add the new user

Log in to your server and type the following command. Replace myname with whatever username you want to use:

adduser myname

The server will ask you for a password. Pick a strong one! It will then ask for some contact info (Name, Room Number, etc.). You can just hit Enter to skip through these.

2. Add the user to the sudo group

Now we need to tell the server that myname is allowed to run administrator commands.

usermod -aG sudo myname

Test it out: Log out of your server (type exit). Then, try to log back in with your new username. Once you are in, type sudo ls /root. If it asks for your password and shows you the files, you are good to go!

---

Step 2: Disable Root Login

Now that your new user is working, we are going to cut off access for the root user via SSH. This is a huge security upgrade because hackers always try to log in as “root” first.

Warning: Make sure you can log in with your new user before you do this step!

1. Open the SSH configuration file

We need to edit a settings file. We will use a text editor called nano.

sudo nano /etc/ssh/sshd_config

2. Change the setting

Scroll down until you find a line that looks like this:

PermitRootLogin yes

Change “yes” to “no”:

PermitRootLogin no

(Note: If the line has a # symbol at the start, delete the #).

Press Ctrl+O then Enter to save, and Ctrl+X to exit.

3. Restart SSH

For the changes to take effect, restart the service:

sudo systemctl restart ssh

---

Step 3: Set Up a Firewall and Fail2Ban

Think of a firewall as a gatekeeper that only lets specific traffic in. Think of Fail2Ban as a security guard who watches the security cameras. If someone tries to guess your password 5 times in a row, Fail2Ban bans their IP address immediately.

1. Configure the UFW Firewall

Ubuntu comes with UFW (Uncomplicated Firewall). Let’s set it up.

First, make sure we allow SSH connections (so you don’t lock yourself out!):

sudo ufw allow OpenSSH

Now, turn the firewall on:

sudo ufw enable

Type y and hit Enter when it asks for confirmation.

2. Install Fail2Ban

Now let’s install the tool that stops brute-force attacks.

sudo apt update
sudo apt install fail2ban -y

3. Configure Fail2Ban

We shouldn’t edit the default config file. Instead, we make a copy of it called jail.local. This keeps our settings safe during updates.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, let’s open that file:

sudo nano /etc/fail2ban/jail.local

Scroll down to the [sshd] section. It usually looks like this:

[sshd]
enabled = true
port    = ssh
filter  = sshd
logpath = /var/log/auth.log
maxretry = 5

If enabled is not set to true, change it. You can also lower maxretry to 3 if you want to be extra strict. Once you are done, save and exit (Ctrl+O, Enter, Ctrl+X).

4. Start Fail2Ban

Turn it on and make sure it starts automatically if the server reboots:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

You can check the status anytime to see if it’s running (and see how many bad guys have been banned) by typing:

sudo fail2ban-client status sshd

---

Other Quick Recommendations

If you want to go the extra mile, here are two more things you should consider:

• Use SSH Keys instead of passwords: Passwords can be guessed. SSH keys use cryptographic files on your computer to log in. It is much harder to hack.
• Enable Automatic Updates: Ubuntu can automatically install security patches so you don’t forget. You can do this by installing the unattended-upgrades package.

And that’s it! Your Ubuntu 24 server is now much harder to break into. Need assistance? InterServer support staff can help secure your VPS or server following the above best practices.