Setting up a Virtual Private Server (VPS) is one of the first steps toward hosting a website, running a web application, or managing your own online infrastructure. However, a newly created VPS is not automatically ready for production use. Before hosting anything, you need to prepare the operating system, secure remote access, configure a firewall, install a web server, and enable encrypted connections.
Ubuntu is a popular choice for VPS hosting because it provides a stable Linux environment, extensive documentation, and access to a large collection of software packages. Combined with Nginx, UFW, and Let's Encrypt, it provides the basic infrastructure needed to host a website.
This guide explains how to set up a VPS from scratch using Ubuntu, configure SSH key authentication, install Nginx, protect the server with UFW, and obtain a free SSL/TLS certificate through Certbot.
The instructions assume you have a newly provisioned Ubuntu VPS, a computer with an SSH client, and a domain name that you intend to connect to the server.
1. Prepare Your VPS
The first step is to create a VPS through your hosting provider. Most VPS providers allow you to select an operating system, server location, CPU allocation, RAM, and storage capacity during deployment.
For this setup, select an Ubuntu Server installation. Using an Ubuntu LTS release is a practical choice because it receives long-term maintenance and security updates.
Once the VPS has been created, your hosting provider should supply the information required to access it. This normally includes:
The server's public IP address.
The initial login username.
An initial password or another authentication method.
Access to the provider's management dashboard.
You should also confirm that your VPS has a public IP address and that its networking configuration allows incoming SSH connections.
Before proceeding, check the provider's firewall or network security settings. Some hosting companies operate an external firewall in addition to the firewall configured inside Ubuntu. Both must permit the traffic required for your server.
For this guide, the standard ports are:
If your VPS provider uses a different SSH port, account for that when configuring the firewall.
2. Connect to the Server Through SSH
SSH (Secure Shell) allows you to access and manage your VPS remotely through an encrypted connection.
On Linux and macOS, you can use the built-in terminal. Windows users can use Windows Terminal or PowerShell.
Open your terminal and enter:
ssh root@YOUR_SERVER_IP
Replace YOUR_SERVER_IP with the public IP address assigned to your VPS.
If the server uses a different initial username, replace root with that username.
On your first connection, SSH may ask you to verify the server's host key. Confirm that the fingerprint matches information supplied through your hosting provider or another trusted channel before accepting it.
Once authenticated, you should have access to the server's command line.
The initial account may have administrative privileges. If you are logging in as root, remember that commands can modify or delete critical system files. A dedicated administrative account is preferable for routine server management.
3. Update Ubuntu and Install Essential Packages
A newly deployed VPS may not contain the latest available package updates. Updating the system before installing additional software reduces the risk of running outdated packages.
Run:
apt update
apt upgrade -y
The first command refreshes the package index. The second installs available package upgrades.
Next, install a few useful utilities:
apt install -y curl wget nano unzip git ufw
These packages provide tools for downloading files, editing configuration files, managing archives, working with Git repositories, and configuring the firewall.
After the update, check the Ubuntu version:
lsb_release -a
You can also check the system's hostname:
hostnamectl
If the VPS requires a reboot after installing kernel or other system updates, restart it:
reboot
Wait for the server to become available again before reconnecting through SSH.
4. Create a Non-Root Administrative User
Using the root account for every administrative task increases the risk of accidental system damage. A better approach is to create a separate user account with administrative privileges.
Run:
adduser adminuser
Replace adminuser with your preferred username.
Ubuntu will request a password and may ask for additional account information.
Next, add the account to the sudo group:
usermod -aG sudo adminuser
This allows the account to execute administrative commands using sudo.
For example:
sudo apt update
You can now establish a separate SSH session using the new account:
ssh adminuser@YOUR_SERVER_IP
Keep your existing root session open until you have confirmed that the new account can connect and execute administrative commands successfully.
5. Configure SSH Key Authentication
SSH key authentication is an important security improvement for a VPS.
Instead of relying exclusively on an account password, SSH uses a cryptographic key pair consisting of a private key and a public key.
The private key remains on your local computer. The public key is placed on the VPS. During authentication, SSH uses the corresponding keys to verify access.
Ubuntu's official documentation recommends the Ed25519 algorithm for generating SSH keys.
Generate an SSH key pair
On your local computer, open a terminal and run:
ssh-keygen -t ed25519
The command will ask where you want to save the key.
You can accept the default location or specify a separate filename.
It will also request a passphrase. Using a passphrase adds protection if someone obtains access to your private key.
The generated files normally include:
id_ed25519, your private key.
id_ed25519.pub, your public key.
Never share your private key or upload it to your VPS.
Copy the public key to your VPS
The easiest method on systems with OpenSSH utilities is:
ssh-copy-id adminuser@YOUR_SERVER_IP
Enter the account password when requested.
The command copies the public key into the remote account's ~/.ssh/authorized_keys file.
If ssh-copy-id is unavailable, you can add the public key manually.
First, display the public key on your local computer:
cat ~/.ssh/id_ed25519.pub
Copy the complete output.
Connect to your VPS and create the required directory:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
Open the authorized keys file:
nano ~/.ssh/authorized_keys
Paste the public key, save the file, and apply the correct permissions:
chmod 600 ~/.ssh/authorized_keys
Test SSH key authentication
Open a new terminal window on your local computer and connect:
ssh adminuser@YOUR_SERVER_IP
If the configuration is correct, SSH should authenticate using your private key, potentially requesting its passphrase.
Do not disable password authentication until you have successfully tested key-based access in a separate session.
Disable SSH password authentication
After confirming that key authentication works, you can disable password-based SSH login.
Create a configuration file:
sudo nano /etc/ssh/sshd_config.d/00-local.conf
Add:
PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin no
These settings enable public key authentication, disable SSH password authentication, and prevent direct root login.
Check the SSH configuration before applying the changes:
sudo sshd -t
If the command produces no error, reload the SSH service:
sudo systemctl reload ssh
Keep your existing session open and test another connection using the administrative account.
Also check the effective SSH settings if your VPS provider supplies additional SSH configuration files:
sudo sshd -T | grep -E 'pubkeyauthentication|passwordauthentication|permitrootlogin'
This helps identify settings that may be affected by other configuration files.
6. Configure the UFW Firewall
A firewall controls which network connections are permitted to reach your VPS.
Ubuntu includes UFW, which stands for Uncomplicated Firewall. It provides a straightforward interface for managing firewall rules.
Before enabling UFW, allow SSH access. Otherwise, you could block your own remote connection.
Run:
sudo ufw allow OpenSSH
Next, allow HTTP and HTTPS traffic:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
These rules permit incoming web traffic on the standard HTTP and HTTPS ports.
Now enable the firewall:
sudo ufw enable
UFW may display a warning about interrupting existing SSH connections. Because you have already allowed SSH, you can proceed.
Check the firewall status:
sudo ufw status verbose
You should see rules allowing SSH, HTTP, and HTTPS traffic.
For a standard website, these are the essential incoming connections.
Do not open additional ports unless your application requires them. Database services, administrative panels, and internal application services should not automatically be exposed to the public internet.
If your SSH service uses a custom port, allow that specific port before enabling UFW.
Also check your hosting provider's external firewall. An incoming connection can still be blocked at the provider level even when UFW permits it.
7. Install Nginx on Ubuntu
Nginx is a web server commonly used to serve websites, deliver static files, and operate as a reverse proxy for web applications.
To install Nginx, update the package index and install the package:
sudo apt update
sudo apt install nginx -y
Ubuntu will install the required dependencies and start the Nginx service.
Check whether Nginx is running:
sudo systemctl status nginx
If the service is active, the installation was successful.
You can also enable Nginx to start automatically when the VPS boots:
sudo systemctl enable nginx
Open a browser and enter your server's public IP address:
http://YOUR_SERVER_IP
You should see the default Nginx welcome page.
This confirms that the web server is responding to HTTP requests.
8. Configure an Nginx Server Block for Your Domain
The default Nginx configuration is sufficient for an initial installation, but a production website should have its own server block.
A server block allows Nginx to associate a domain name with a particular website directory and its configuration.
First, create a directory for your website:
sudo mkdir -p /var/www/example.com/html
Set ownership and directory permissions:
sudo chown -R $USER:$USER /var/www/example.com/html
sudo chmod -R 755 /var/www/example.com
Create a basic HTML page:
nano /var/www/example.com/html/index.html
Add:
<!DOCTYPE html>
<html>
<head>
<title>My Website</title>
</head>
<body>
<h1>Welcome to My Website</h1>
<p>My VPS is running Ubuntu and Nginx.</p>
</body>
</html>
Save the file.
Next, create an Nginx configuration file:
sudo nano /etc/nginx/sites-available/example.com
Add the following configuration:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example.com/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}
Replace example.com with your actual domain name.
Enable the configuration by creating a symbolic link:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
Check the Nginx configuration:
sudo nginx -t
If the test succeeds, reload Nginx:
sudo systemctl reload nginx
You should now be able to access your website through its domain name, provided that DNS is correctly configured.
9. Point Your Domain Name to the VPS
Before requesting an SSL/TLS certificate, make sure your domain points to the correct server.
Log in to your domain registrar or DNS hosting provider and locate the DNS management section.
Create the following records:
A record
A record for www
If your VPS has a public IPv6 address, you can also configure appropriate AAAA records.
An incorrect AAAA record can cause connection problems for clients attempting to access your website over IPv6. Make sure any published IPv6 address actually belongs to your server and is configured to serve the website.
DNS changes may take time to become visible because of DNS caching and the TTL settings of the records.
You can check DNS resolution using:
dig example.com
And:
dig www.example.com
Both names should resolve to the addresses configured for your VPS.
Before requesting a certificate, verify that your domain can reach Nginx over HTTP.
10. Install Certbot and Obtain a Let's Encrypt Certificate
HTTPS protects connections between a visitor's browser and your website through TLS encryption.
Let's Encrypt provides free certificates, while Certbot automates the process of obtaining and installing them.
For Ubuntu with Nginx, the Certbot Snap installation method is documented by the Electronic Frontier Foundation's Certbot instructions.
First, install Certbot:
sudo snap install --classic certbot
Create the command-line link:
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
Next, obtain and install the certificate:
sudo certbot --nginx
Certbot will request the necessary information, including your email address and the domain names you want to secure.
Follow the prompts.
If domain validation succeeds, Certbot obtains the certificate and updates the Nginx configuration to enable HTTPS.
The standard HTTP-01 validation method requires the domain to be publicly reachable on port 80. Therefore, make sure that your DNS records are correct and that neither UFW nor your hosting provider's firewall blocks incoming HTTP connections.
After successful installation, open:
https://example.com
Your website should now load through an encrypted HTTPS connection.
If you selected both the root domain and its www version during certificate issuance, test both addresses.
11. Verify SSL and Configure Automatic Renewal
Obtaining a certificate is only part of the process. You also need to confirm that renewal works.
Let's Encrypt certificates have a limited validity period. Certbot can automatically renew certificates before expiration when its renewal mechanism is correctly installed and operating.
Test the renewal process:
sudo certbot renew --dry-run
This performs a renewal test without replacing the active certificate.
If the test succeeds, Certbot's renewal configuration is functioning as expected.
You can inspect available systemd timers using:
systemctl list-timers
You can also check Certbot's installed certificates:
sudo certbot certificates
This displays certificate information, including the covered domain names and expiration dates.
Do not assume renewal is working simply because the first certificate was issued successfully. Run the renewal test and investigate any errors.
12. Final VPS Security and Maintenance Checks
At this stage, your VPS has Ubuntu, SSH key authentication, UFW, Nginx, and an SSL/TLS certificate.
However, initial configuration does not eliminate the need for ongoing maintenance.
Before putting the server into production, check the following:
System updates
Run:
sudo apt update
sudo apt upgrade
Install available security and software updates regularly.
SSH access
Confirm that you can connect using your administrative account and private key. Keep the private key protected and maintain a secure backup.
Firewall rules
Check:
sudo ufw status verbose
Make sure only the required services are accessible.
Nginx service
Check:
sudo systemctl status nginx
Test its configuration:
sudo nginx -t
SSL certificate
Check:
sudo certbot certificates
Confirm that the correct domains are covered and that automatic renewal works.
Server backups
Configure backups through your VPS provider or another reliable backup system. Keep copies of important website files, application data, configuration files, and databases.
A VPS can fail because of hardware problems, software errors, accidental deletion, or security incidents. A backup stored only on the same server does not provide adequate protection against every failure.
Conclusion
Setting up a VPS from scratch requires more than installing an operating system and launching a web server. Proper configuration involves securing remote access, managing network traffic, installing the necessary services, connecting a domain name, and enabling encrypted communication.
Ubuntu provides the operating system, SSH key authentication protects administrative access, UFW controls incoming connections, and Nginx handles website requests. Certbot and Let's Encrypt complete the process by providing an automated method for obtaining and renewing SSL/TLS certificates.
Once these components are configured and tested, you have a functional foundation for hosting a website or deploying a web application.
Continue maintaining the server through regular updates, firewall reviews, backup checks, and certificate renewal tests. These tasks are essential for keeping a VPS accessible and secure over time.
What is man, that thou art mindful of him? Psalm 8:4
Comments
Post a Comment
Please keep comments respectful. Promotional links and spam will be removed.