A new Ubuntu server on Joy is reachable from the whole internet within a minute of boot, and password-guessing bots find it within the hour. Ten minutes of work closes the obvious doors. Everything below is copy-paste safe on Ubuntu 24.04 and 22.04.
1. Update
apt update && apt upgrade -y && reboot2. SSH keys, no passwords
# from your computer
ssh-copy-id root@YOUR_IP
# on the server, after confirming key login works in a NEW terminal
printf 'PasswordAuthentication no\nPermitRootLogin prohibit-password\n' > /etc/ssh/sshd_config.d/50-joy.conf
sshd -t && systemctl restart ssh3. A non-root user with sudo
adduser deploy && usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy4. Firewall
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw default deny incoming
ufw enable5. Automatic security updates
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades6. Fail2Ban
apt install fail2ban -y
cat > /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
maxretry = 5
bantime = 1h
EOF
systemctl enable --now fail2ban
fail2ban-client status sshd7. Time, swap and a snapshot
timedatectl set-timezone Asia/Kolkata # or your zone
# 1–2 GB servers: add swap so MySQL does not get OOM-killed
fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstabFinally, take a snapshot from the server page so you can roll back after experiments. That is the baseline; the firewall guide and SSH keys guide go deeper.