Lock the doors before you move in

Your server is out on the open internet right now, and it's already being noticed. Before we install anything fun, let's put four simple locks on the front door — it only takes a few minutes.

Why security comes before anything else

Here's a fact that surprises most beginners: the moment a new server gets an internet address, automated programs called "bots" start knocking on it — often within minutes. They're not targeting you personally. They're scanning the whole internet, all day, every day, looking for easy, unlocked doors.

Think of your new server like an apartment you just moved into. You wouldn't leave the front door wide open on night one, even if you don't own anything valuable yet. You'd lock up first, then unpack. That's exactly what this module does — we lock up before we put anything real inside.

Lock 1 — Update everything

Software gets small safety fixes all the time. An out-of-date server is like a door with an old, weak lock — someone's already figured out how to pick it. So the very first thing we do is bring everything up to date.

sudo apt update && sudo apt upgrade -y

apt is the "app store" for your server — the tool that installs and updates software. Running update refreshes its list of what's available (like refreshing a store's shelves), and upgrade -y installs the newest, safest versions of everything you already have. sudo just means "do this as admin" — some jobs need that extra permission.

Lock 2 — Stop living as root

Right now you're logged in as root, the server's super-admin account. Root can do anything — including anything a mistake, or an attacker, tells it to do. If root gets compromised, everything is compromised. So we're going to create a normal, everyday user, and save root for rare emergencies only.

# pick your own name; it will ask you to set a password
adduser mike

# gives 'mike' permission to use sudo
usermod -aG sudo mike

Swap mike for whatever username you'd like — just use that same name everywhere below. adduser creates the new account and walks you through setting a password. usermod -aG sudo mike adds that user to the special "sudo" group, so they can still ask for admin power when they truly need it, one command at a time — instead of having it always switched on, like root does.

Your new user also needs a way to log in. Back in Module 3 you set up an SSH key — copy it over to the new account:

rsync --archive --chown=mike:mike ~/.ssh /home/mike

This copies your .ssh folder (which holds the "key" that proves it's you) from root's home into your new user's home, and hands ownership of those files to that user. Again, replace mike with your chosen username in both places.

Lock 3 — Turn on a firewall

A firewall is like a guard standing at every "door" on your server. A port is simply one of those doors, numbered — door 80 is for regular web traffic, door 443 is for secure web traffic, and door 22 is for SSH, the connection you're using right now. By default we want the guard to block every door except the handful we actually use.

Ubuntu ships with a friendly firewall tool called ufw — Uncomplicated Firewall. Here's how to turn it on safely:

# keep your SSH door open (VERY important, do this first)
sudo ufw allow OpenSSH

# web traffic (http)
sudo ufw allow 80/tcp

# secure web traffic (https)
sudo ufw allow 443/tcp

# turn the firewall on
sudo ufw enable

# check what's allowed
sudo ufw status

Lock 4 — Harden SSH itself

SSH is the front door you use to reach your server. Two settings make that door much sturdier: banning root from logging in directly, and turning off password guessing entirely. Open the SSH settings file:

sudo nano /etc/ssh/sshd_config

Inside, find these two lines (use your arrow keys to scroll — no mouse needed). If a line starts with a #, remove it, and make sure each line reads exactly:

PermitRootLogin no
PasswordAuthentication no

Save the file with Ctrl+O then Enter, and exit with Ctrl+X. Then restart SSH so the new settings take effect:

sudo systemctl restart ssh

PermitRootLogin no means nobody — not even someone who somehow guesses the root password — can log straight in as root anymore. PasswordAuthentication no turns off password logins completely, so only your SSH key (the one only you have) can get you in. No amount of password guessing will work.

✏️ Hands-on: your security checklist

Work through this list in order, right now, on your own server. Each step builds on the one before it.

1. Update the server

   Run sudo apt update && sudo apt upgrade -y and let it finish.

2. Create your everyday user

   Run adduser yourname and set a strong password when it asks.

3. Add that user to sudo

   Run usermod -aG sudo yourname so they can still do admin tasks when needed.

4. Copy your SSH key over

   Run the rsync command so your new user can log in with the same key.

5. Turn on the firewall — OpenSSH first!

   Allow OpenSSH, then port 80, then port 443 — then run sudo ufw enable.

6. Turn off root login and password login

   Edit /etc/ssh/sshd_config, set both lines to no, and restart SSH.

7. Test in a second window

   Open a new terminal and confirm ssh yourname@YOUR_SERVER_IP works before closing anything.