Background
After creating a new Ubuntu 18.04 server, you should take some configuration steps as part of an initial server setup in order to increase security and facilitate management later.
This guide will walk you through a few procedures that you should complete early on in order to create a solid foundation for your new server, before moving on to installing and configuring any software or services.
1 — Logging in as Root
A root account is often set up on newly installed servers, and this is the account you'll use to log into your server for the first time.
The root user is an administrative user with extensive permissions. Because of the root account's elevated privileges, you should avoid utilizing it on a frequent basis. This is because the root account's intrinsic authority includes the ability to make extremely devastating modifications, even by accident. As a result, it's best to create a regular system user and grant this user sudo capabilities so that it can run administrative commands with some restrictions. You'll create such a user in the next step.
You'll need to log into your server to get started. Ascertain that you are aware of your server's public IP address. If you've set up an SSH key for authentication within the server, you'll need either the account's password or the SSH private key for the root user's account to authenticate. If you haven't already done so, check out our instruction on how to connect to your Droplet with SSH, which walks you through the procedure step by step.
If you are not already connected to your server, go ahead and log in as the root user with the following command. Be sure to replace the highlighted portion of the command with your server’s public IP address:
Accept the warning about host authenticity if it appears. If you are using password authentication, provide your root password to log in. Alternatively, if you are using an SSH key that is passphrase protected, you may be prompted to enter the passphrase the first time you use the key each session. Additionally, if this is your first time logging into the server with a password, you may also be prompted to change the root password.
In the next step, you’ll set up a new system user account with reduced privileges, and configure this user to run administrative commands via sudo.
2 — Creating a New User
Once you are logged in as root, you can create a new user that will be your regular system user from now on.
The following example creates a new user called sammy, but you should replace it with a username of your choice:
adduser sammy
You'll be asked a few questions, the first of which will be your account password.
Fill in a strong password and, if desired, any of the additional information. This isn't necessary; you can simply press ENTER in any field you want to skip.
You'll set up sudo rights for this account in the next step. Through the sudo software, the user will be able to do administrative duties as the root user.
3 — Granting Administrative Privileges
You now have a new user account with standard permissions. However, you may be required to conduct administration chores such as managing servers, modifying configuration files, or restarting a server from time to time.
You can set up "superuser" or root rights for your normal account to prevent having to log out of your regular user and back in as the root account. By prefixing each command with the term sudo, your regular user will be able to perform commands with administrator rights.
To give your new user these access, you must add them to the sudo group. Users in the sudo group are able to use the sudo command by default in Ubuntu 18.04.
The following command will modify the default user settings, including the sudo group in the list of groups a user already belongs to. Pay attention to the -a argument, which stands for append. Without this option, the current groups a user is linked to would be replaced by sudo, which would cause unexpected consequences. The -G argument tells usermod to change a user’s group settings.
As root, run this command to add your new user to the sudo group (replace the highlighted word with your new user):
usermod -aG sudo sammy
Your system user is now set up. In the next step, you’ll configure a basic firewall for your server.
4 — Setting Up a Basic Firewall
UFW (Uncomplicated Firewall) is a firewall configuration tool that comes with Ubuntu servers. You can use the UFW firewall to make sure only connections to certain services are allowed on your server.
Applications can register their profiles with UFW upon installation. These profiles allow UFW to manage per-application settings by name. OpenSSH, the service allowing you to connect to your server now, has a profile registered within UFW.
Run the following command to get a list of all currently available profiles:
ufw app list
Available applications: OpenSSH
You need to make sure that the firewall allows SSH connections so that you can log back in next time. You can allow these connections by typing:ufw allow OpenSSHAfterwards, you can enable the firewall with:ufw enableType “y” and press ENTER to proceed. You can see that SSH connections are still allowed by typing:
ufw status
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)As the firewall is currently blocking all connections except for SSH, if you install and configure additional services, you will need to adjust the firewall settings to allow acceptable traffic in.
5 — Enabling External Access for Your Regular User
Now that you have a regular user for daily use, you need to make sure you can SSH into the account directly.
Note: Until verifying that you can log in and use sudo as your new user, we recommend staying logged in as root. This way, if you have problems, you can troubleshoot and make any necessary changes as root. If you are using a DigitalOcean Droplet and experience problems with your root SSH connection.
The process for configuring SSH access for your new user depends on whether your server’s root account uses a password or SSH keys for authentication.
If the Root Account Uses Password Authentication
If you logged in to your root account using a password, it means that password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:
After entering your regular user’s password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:
sudo command_to_run
You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).
To enhance your server’s security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Ubuntu 18.04 to learn how to configure key-based authentication.
If the Root Account Uses SSH Key Authentication
If you logged in to your root account using SSH keys, it’s likely that password authentication is disabled for SSH. You will need to add a copy of your local public key to the new user’s ~/.ssh/authorized_keys file to log in successfully.
Since your public key is already in the root account’s ~/.ssh/authorized_keys file on the server, you can copy that file and directory structure to your new user account in your existing session.
The simplest way to copy the files with the correct ownership and permissions is with the rsync command. This will copy the root user’s .ssh directory, preserve the permissions, and modify the file owners, all in a single command. Make sure to change the highlighted portions of the following command to match your regular user’s name:
Note: The rsync command treats sources and destinations that end with a trailing slash differently than those without a trailing slash. When using rsync below, be sure that the source directory (~/.ssh) does not include a trailing slash (check to make sure you are not using ~/.ssh/).
If you accidentally add a trailing slash to the command, rsync will copy the contents of the root account’s ~/.ssh directory to the sudo user’s home directory instead of copying the entire ~/.ssh directory structure. The files will be in the wrong location and SSH will not be able to find and use them.
You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).
To enhance your server’s security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Ubuntu 18.04 to learn how to configure key-based authentication.
rsync --archive --chown=sammy:sammy ~/.ssh /home/sammy
Now, open up a new terminal session and try to log in with your new username:
You should be able to log into the new user account without being prompted for the remote user’s SSH password for authentication. If your SSH key was set up with a keyphrase, you may be asked to unlock the SSH key by providing that password when you use the key for the first time in a terminal session.
Remember, if you need to run a command with administrative privileges, type sudo before it like this:
sudo command_to_run
You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).
