Ubuntu after install

The first five minutes

Three commands and one reboot, before anything else.

# 1. bring the system fully up to date
sudo apt update
sudo apt upgrade -y

# 2. firmware updates - laptops especially
fwupdmgr refresh
fwupdmgr get-updates
fwupdmgr update

# 3. reboot if a new kernel arrived
ls /var/run/reboot-required && sudo reboot

On a VPS, the same four commands at first login

ssh root@203.0.113.10

apt update && apt upgrade -y

hostnamectl set-hostname web01
timedatectl set-timezone Asia/Bahrain

ls /var/run/reboot-required && reboot

Name the host something you will recognise at 3 a.m., not server1. Thirty seconds of sanity checking confirms the machine you are paying for is the machine you ordered.

Most VPS images ship with no swap. On a 2 GB machine that is worth fixing before you run a database — a 2 GB swap file costs nothing and stops the out-of-memory killer ending your database at 3 a.m.

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

How apt actually works

Six subcommands cover everything. Two of them are constantly confused with each other.

update and upgrade are not the same thing. update asks "what is available?" and upgrade says "install it". Running upgrade without update first means upgrading against a stale list — which is why every guide chains them with &&.

Keep full-upgrade for release jumps rather than routine updating — letting apt remove a package is a decision worth making deliberately.

The packages worth installing on day one

One command. Everything here earns its place within the first week.

sudo apt install -y \
    build-essential git curl wget vim nano \
    htop btop net-tools dnsutils traceroute \
    tree unzip zip p7zip-full \
    ufw gnupg ca-certificates \
    tlp gnome-tweaks ubuntu-restricted-extras

On a server, drop the last line — tlp, gnome-tweaks and the restricted extras are desktop packages.

Stop being root

Every action attributed, every mistake recoverable. Every guide from here on assumes it.

# create a user for yourself
adduser deploy
usermod -aG sudo deploy

# give it your SSH key
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

# test it from a SECOND terminal
ssh deploy@203.0.113.10
sudo whoami        # -> root

The security baseline

Keys, three config lines and a firewall in the right order. The highest-value fifteen minutes of the whole build.

Keys instead of passwords

# on your own machine
ssh-keygen -t ed25519 -C 'you@laptop'
ssh-copy-id user@server

# then, on the server - the three lines
sudo nano /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

sudo sshd -t        # test the config FIRST
sudo systemctl reload ssh

sshd -t is not optional ceremony. It catches the typo that would otherwise lock you out the moment you reload.

The firewall, in this order

# SSH first, then the web ports, then enable
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Your provider's firewall — Hetzner, DigitalOcean, AWS security groups — sits in front of the machine, and ufw can neither see nor override it. If curl works on the server but not from your laptop, that outer layer is why. Use both: defence in depth costs nothing here.

Bots, and patches that land by themselves

# jail the ones knocking
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

# see what you are protected from
sudo grep 'Failed password' /var/log/auth.log | wc -l

# security patches applied automatically
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
systemctl status unattended-upgrades

unattended-upgrades belongs beside the firewall, not after it: a firewall does not help if the service behind it is months out of date.

Backups, before you have anything to lose

The one task everybody postpones until the week after they needed it.

Snapshots and backups are not the same thing

Turn on the provider's automatic snapshots when you create the server — they usually cost about 20% and are the fastest possible recovery from a broken upgrade. Then add file backups for what snapshots cannot do.

# built in, graphical, good enough for a laptop
sudo apt install -y deja-dup

# versioned, encrypted, scriptable
sudo apt install -y restic
restic init --repo /mnt/backup
restic -r /mnt/backup backup /home/you /var/www /etc
restic -r /mnt/backup snapshots
restic -r /mnt/backup forget \
  --keep-daily 7 --keep-weekly 4 --prune

# dump the database, do not copy its live files
mysqldump -u root -p --all-databases > dump.sql

# and the step nobody does
restic -r /mnt/backup restore latest --target /tmp/test

Put a restore in your calendar once a quarter. Restoring one random file proves the whole chain works — and it is the only proof that counts.

Drivers, firmware and the graphics question

Ubuntu handles most hardware automatically. These are the exceptions.

Wayland or X11? Ubuntu defaults to Wayland, which is smoother on most hardware. If you hit screen-sharing or NVIDIA oddities, pick "Ubuntu on Xorg" from the gear icon on the login screen — it is a per-session choice, not a permanent one.

Make the desktop yours

Fifteen minutes of settings that you will feel every day afterwards.

Two shortcuts worth learning immediately: Super opens the activities overview, and Super + A shows every installed application. Almost nobody needs a desktop icon again after that.

Set up the terminal once, use it for years

Aliases and a prompt you can read save minutes every single day.

# ~/.bashrc - add at the end
alias ll='ls -alF'
alias ..='cd ..'
alias update='sudo apt update && sudo apt upgrade -y'
alias ports='sudo ss -tulpn'
alias myip='curl -s ifconfig.me'

export HISTSIZE=10000
export HISTCONTROL=ignoreboth:erasedups

source ~/.bashrc

Zsh with oh-my-zsh is popular and pretty. Bash is what every server you ever log into actually has. Learn bash first; add zsh on your own machine afterwards if you want it.

A development environment in ten minutes

If the machine is for work, these four steps come before anything else.

# compilers and headers
sudo apt install -y build-essential

# git, configured properly
sudo apt install -y git
git config --global user.name 'Your Name'
git config --global user.email 'you@example.com'
git config --global init.defaultBranch main

# an SSH key for GitHub or GitLab
ssh-keygen -t ed25519 -C 'you@example.com'
cat ~/.ssh/id_ed25519.pub

# Docker, the official way
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
newgrp docker
docker run hello-world

# languages: use a version manager, not apt
# node   -> nvm
# python -> pyenv or python3-venv
# rust   -> rustup

Do not install Node or Python versions from apt if you develop against specific versions. Version managers let each project use what it needs, and they never fight the system packages that Ubuntu itself depends on.

Adding yourself to the docker group is what stops you prefixing every container command with sudo. It normally applies at your next login — newgrp docker is what makes it apply now.

Point a domain at it

Two records and one wait. This is the step that turns an IP address into something people can use — and the one certbot depends on.

dig +short example.com        # what the world sees
dig @1.1.1.1 example.com      # bypass your local resolver
curl -I http://example.com    # does it reach your server?

Set the TTL low — 300 seconds — before you change anything, and raise it once things are stable. A mistake then costs five minutes instead of a day. Propagation is usually minutes, occasionally hours.

A web server and a real certificate

Ten minutes from a bare server to a padlock in the address bar.

sudo apt install -y nginx
systemctl status nginx

# your site's files
sudo mkdir -p /var/www/example.com/html
echo '<h1>It works.</h1>' | \
  sudo tee /var/www/example.com/html/index.html

sudo nano /etc/nginx/sites-available/example.com
sudo ln -s /etc/nginx/sites-available/example.com \
           /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

sudo apt install -y certbot python3-certbot-nginx

sudo certbot --nginx -d example.com -d www.example.com

# certbot edits the config and reloads nginx for you
sudo certbot certificates
sudo certbot renew --dry-run
systemctl list-timers | grep certbot

Renewal is a systemd timer certbot installs for you. renew --dry-run is how you confirm today that it will still work in three months — and an expiring certificate is one of the few things worth alerting on.

Let the machine tell you it is unwell

So you find out before a customer does.

# the four numbers that matter
df -h && free -h && uptime
systemctl --failed

# a dashboard in ten minutes
curl -fsSL https://get.netdata.cloud/kickstart.sh | sh

# do not expose it to the internet
sudo ufw allow from YOUR.IP.ADDRESS to any port 19999

Layer a free external uptime check on top — UptimeRobot, Better Stack or Healthchecks.io. A check that runs on the machine cannot tell you the machine is down.