Initial setup of an Ubuntu 20.04 server

Introduction

When you get an Ubuntu 20.04 server from your host, here are the steps to improve its security and give you a solid base for your next configurations.

Step 1 - Logging in as root

Your host will have given you a public IP and a root password for your server. To get in, use this SSH command:

ssh root@ip_public

Accept the host authenticity warning if it appears. The terminal then asks for your password.

Step 2 - Creating a new user that can act as root

A root user can take any action at all in the operating system. Staying in root permanently is asking for an accident. To cut that risk, we switch to root only when we need to.

To create a user, type:

adduser john

To grant root access to that user, enter this command:

usermod -aG sudo john

Now when you log in with that user, you can type sudo in front of commands to act as root.

Step 3 - Changing the SSH port

Changing the SSH port adds a layer of security to your server against automated attacks.

To make the change, open the sshd_config configuration file with a text editor, vi for example:

vi /etc/ssh/sshd_config

Find the Port 22 entry and replace port 22 with a port above 1024:

Port 2021 # for example

Step 4 - Logging in with an SSH key

It's better to use SSH key authentication than password authentication. If you haven't generated an SSH key on your local machine yet, enter this command:

ssh-keygen -t ed25519

The terminal asks what name you'd like to give your key:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/your_home/.ssh/id_ed25519):

Enter a passphrase for your key:

Enter passphrase (empty for no passphrase):

You should end up with something like this:

Your identification has been saved in /your_home/.ssh/id_ed25519
Your public key has been saved in /your_home/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:I5QzXvUbJUM7LcEePKw8Do/YwycJt/CgYxoUe8brCUw pc@host
The key\'s randomart image is:
+--[ED25519 256]--+
| .== .           |
|  . . . .*B      |
|   + = .. o*o.   |
|  E +o++o + .=   |
|   + o ooXSB ..  |
|    + = ..X.+    |
|     \* o +      |
|      . o        |
|                 |
+----[SHA256]-----+

Now you need to copy the public key you generated, /your_home/.ssh/id_ed25519.pub, into the ~/.ssh/authorized_keys file on your server.

The simplest way to do that is the ssh-copy-id command, already built into most Linux distributions. Type this command to make the copy:

ssh-copy-id -i ~/.ssh/id_ed25519.pub john@ip_public

Step 5 - Disabling root login

Now that we have a dedicated sudo user, direct root login should be disabled. In the /etc/ssh/sshd_config file, find the PermitRootLogin directive and replace it with:

PermitRootLogin no

Step 6 - Disabling password authentication

Password authentication is vulnerable to brute force attacks. Now that your SSH key is in place, in /etc/ssh/sshd_config, replace the PasswordAuthentication directive with:

PasswordAuthentication no

Step 7 - Reloading the SSH service

Once you've made all the changes in /etc/ssh/sshd_config, reload the systemd daemon, then restart the SSH socket and service:

systemctl daemon-reload

systemctl restart ssh.socket

systemctl restart ssh

Step 8 - Setting up a firewall

You can use the UFW firewall to make sure only authorized applications have access to the system. UFW ships with Ubuntu but is disabled by default.

Careful: before enabling it, add the SSH port first, the one you use to connect to your server over SSH, or you'll lock yourself out. To allow SSH access to your server:

ufw allow 2021/tcp

You can then enable the firewall with:

ufw enable

The terminal asks for confirmation, so type y and press Enter to continue.

The SSH port is now allowed. You can see the UFW firewall status by typing:

ufw status verbose

Step 9 - Checking the connection

The SSH service is now listening on the new port. To reconnect, you have to specify the port:

ssh user@ip_public -p2021