Stackvora.tech

Ubuntu 24.04 LTS: First 10 Things to Do After Install

Deploying a fresh Ubuntu 24.04 LTS (Noble Numbat) instance, whether it's a virtual machine in the cloud, a bare-metal server, or a new workstation,…

Deploying a fresh Ubuntu 24.04 LTS (Noble Numbat) instance, whether it's a virtual machine in the cloud, a bare-metal server, or a new workstation, requires a set of initial configurations to ensure security, stability, and ease of management. This guide outlines ten essential post-installation steps, focusing on best practices for server environments, but many are equally applicable to desktop deployments.

1. System Update and Upgrade

The first and most critical step is to ensure all installed packages are up-to-date. This fetches the latest security patches and bug fixes. Even with a fresh installation image, some packages might have received updates between the image build date and your installation time.

sudo apt update && sudo apt upgrade -y

The sudo apt update command refreshes the local package index, while sudo apt upgrade -y downloads and installs all available package upgrades. The -y flag bypasses the confirmation prompt for package installations.

2. Create a Non-Root Sudo User and Secure Root Access

Operating directly as the root user is a significant security risk. It's best practice to create a standard user account with administrative (sudo) privileges and then disable direct root login, especially over SSH.

2.1 Create New User

sudo adduser yourusername
sudo usermod -aG sudo yourusername

Replace yourusername with your desired username. The adduser command creates the user and prompts for a password and other details. The usermod -aG sudo command adds the user to the sudo group, granting them administrative privileges.

2.2 Test Sudo Access and Switch

Log out of your current session (if you are logged in as root or the initial installer user) and log back in as yourusername. Test sudo access:

sudo whoami

This should return root, confirming your sudo privileges.

3. Configure SSH for Key-Based Authentication

Password-based authentication for SSH is vulnerable to brute-force attacks. Key-based authentication is significantly more secure. This step assumes you have already generated an SSH key pair on your local machine (e.g., using ssh-keygen -t ed25519).

3.1 Copy SSH Public Key to Server

From your local machine:

ssh-copy-id yourusername@your_server_ip

You will be prompted for yourusername's password on the server.

3.2 Disable SSH Password Authentication

On the server, edit the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Find and modify/add the following lines:

  • PasswordAuthentication no
  • PermitRootLogin no (if you haven't already disabled root login)

After saving the changes, restart the SSH service:

sudo systemctl restart sshd

Always keep a console or another SSH session open while testing SSH configuration changes, in case you lock yourself out.

4. Enable and Configure Uncomplicated Firewall (UFW)

UFW is a user-friendly frontend for iptables. It's crucial to enable a firewall to restrict incoming connections to only necessary services.

sudo ufw allow OpenSSH         # Allows SSH connections on default port 22
sudo ufw enable
sudo ufw status verbose

The allow OpenSSH rule opens TCP port 22 (or whatever port SSH is configured on). After enabling, sudo ufw status verbose shows the active rules. Add rules for any other services your server needs, e.g., HTTP (port 80) or HTTPS (port 443):

sudo ufw allow http
sudo ufw allow https

If you're using a non-standard SSH port (e.g., 2222), you'd use sudo ufw allow 2222/tcp instead of OpenSSH.

5. Install and Configure Fail2ban

Fail2ban scans log files (e.g., /var/log/auth.log, /var/log/nginx/error.log) for suspicious activities like repeated failed login attempts and blocks the originating IP addresses using UFW/iptables.

sudo apt install fail2ban -y

Fail2ban's configuration is managed via .conf files in /etc/fail2ban/. It's best practice to create local override files in /etc/fail2ban/jail.d/ rather than modifying jail.conf directly.

Create a local configuration file:

sudo nano /etc/fail2ban/jail.d/custom.conf

Add the following content to enable SSH protection and set a ban time (e.g., 1 hour = 3600 seconds) and max retries (e.g., 3 attempts):

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
maxretry = 3
bantime = 3600

Restart Fail2ban to apply changes:

sudo systemctl restart fail2ban

You can check its status with sudo systemctl status fail2ban and active jails with sudo fail2ban-client status.

6. Enable Unattended Upgrades

Unattended upgrades automate the installation of security updates, reducing the manual overhead and ensuring your system remains secure without constant intervention. For server environments, this is often a critical security measure.

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

The dpkg-reconfigure command will walk you through enabling automatic updates. Confirm that you want to enable automatic updates. You can further customize its behavior by editing /etc/apt/apt.conf.d/50unattended-upgrades, for example, to include specific package origins, auto-reboot behavior, or email notifications.

A common modification for servers is to ensure automatic reboots are handled gracefully, or scheduled for off-peak hours. In 50unattended-upgrades, look for the following lines:

// Unattended-Upgrade::Automatic-Reboot "false";
// Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Uncomment and set Automatic-Reboot "true"; and configure a suitable reboot time if automatic reboots are acceptable for your application. If not, plan for regular manual reboots.

7. Set Hostname and Timezone

A descriptive hostname helps identify your server in a network. Correct timezone settings are crucial for logging, scheduling, and consistent data interpretation.

7.1 Set Hostname

sudo hostnamectl set-hostname your-new-hostname
echo "127.0.0.1 your-new-hostname" | sudo tee -a /etc/hosts

Replace your-new-hostname with something meaningful, e.g., webserver01.example.com. The second command ensures the new hostname resolves locally.

7.2 Set Timezone

sudo timedatectl set-timezone America/New_York  # Replace with your timezone
timedatectl

Use timedatectl list-timezones to find your specific timezone string.

8. Install Monitoring Tools (e.g., Node Exporter for Prometheus)

Monitoring is vital for understanding system performance, identifying issues proactively, and capacity planning. For Prometheus-based monitoring, Node Exporter is a popular choice for collecting host-level metrics.

sudo apt install prometheus-node-exporter -y

By default, Node Exporter listens on port 9100. If you have UFW enabled, remember to allow access:

sudo ufw allow 9100/tcp

Node Exporter runs as a systemd service automatically after installation. You can check its status:

sudo systemctl status prometheus-node-exporter

Metrics will be available at http://your_server_ip:9100/metrics. Configure your Prometheus server to scrape this endpoint.

9. Plan and Implement a Backup Strategy

Data loss is inevitable without a robust backup plan. The choice of backup tool depends on your needs (local vs. cloud, full vs. incremental, encryption, etc.). Two popular tools are Restic and Rclone.

9.1 Restic (Deduplicating, Encrypted Backups)

sudo apt install restic -y

Initialize a repository (e.g., on a network share or cloud storage like S3, Backblaze B2):

# Example: Initialize a B2 repository
export B2_ACCOUNT_ID="your_account_id"
export B2_ACCOUNT_KEY="your_account_key"
restic init --repo s3:https://s3.us-east-1.wasabisys.com/your-bucket-name --password-file /path/to/password.txt

Perform a backup:

restic backup /var/www /etc /home/yourusername --repo s3:https://s3.us-east-1.wasabisys.com/your-bucket-name --password-file /path/to/password.txt

Schedule backups using cron, and ensure you regularly test restores.

9.2 Rclone (Cloud Storage Sync/Copy)

sudo apt install rclone -y

Configure Rclone to connect to your chosen cloud storage provider (e.g., Google Drive, S3, Azure Blob):

rclone config

Follow the interactive prompts. Once configured, you can sync data:

# Example: Sync local directory to a remote named "mys3remote"
rclone sync /path/to/local/data mys3remote:your-bucket-name/backup_destination

Rclone is excellent for simple file synchronization and copying to a wide array of cloud providers.

Always store backup passwords/keys securely and separately from the server itself.

10. Review Ubuntu Server Security Guide

While the steps above cover immediate security hardening, it's crucial to consult the official Ubuntu Server Security Guide for comprehensive best practices and deeper insights into securing your system. Ubuntu 24.04 has specific recommendations and features to be aware of.

  • Familiarize yourself with AppArmor profiles for process confinement.
  • Consider using two-factor authentication for SSH if not using key-based access exclusively.
  • Review package management security and cryptographic settings.
  • Understand kernel hardening options.

Regularly reviewing this guide ensures you stay updated with the latest security recommendations pertinent to your Ubuntu version.

Common Pitfalls and Troubleshooting

  • Locked out via SSH: Always keep a console session (physical or virtual, e.g., cloud provider's web console) open when making SSH configuration changes (sshd_config, UFW rules). This allows you to revert changes if you lock yourself out.
  • UFW Blocking Services: If a service isn't reachable, check sudo ufw status verbose. You might have forgotten to open the necessary port. Remember that UFW rules are processed in order; explicit DENY rules can override ALLOW rules.
  • Hostname Issues: After changing the hostname, ensure /etc/hosts is updated and that local applications recognize the change. Some services might require a reboot or restart.
  • Fail2ban Overzealous: If Fail2ban is banning legitimate IPs, check its logs (/var/log/fail2ban.log) and adjust maxretry and bantime parameters in your jail.d/*.conf files. You can unban an IP manually with sudo fail2ban-client unban <IP_ADDRESS>.
  • Unattended Upgrades Rebooting Unexpectedly: If your server applications are sensitive to reboots, ensure Unattended-Upgrade::Automatic-Reboot "false"; is uncommented and set in /etc/apt/apt.conf.d/50unattended-upgrades.

Back to the knowledge base · Ask the AI assistant