When you first create a new Ubuntu server, you should perform some important configuration steps as part of the initial setup. These steps will increase the security and usability of your server and will give you a solid foundation for subsequent actions.
Deploy your applications from GitHub using DigitalOcean App Platform. Let DigitalOcean focus on scaling your app.
To log into your server, you will need to know your server’s public IP address. You will also need the password or the private key for the root user’s account if you installed an SSH key for authentication. If you have not already logged into your server, you may want to follow our guide on how to Connect to Droplets with SSH, which covers this process in detail.
If you are not connected to your server currently, log in as the root user using the following command. Substitute the highlighted your_server_ip
portion of the command with your server’s public IP address:
- ssh root@your_server_ip
Accept the warning about host authenticity if it appears. If your server uses password authentication, provide your root password to log in. If you use an SSH key that is passphrase protected, you may need to enter the passphrase the first time you use the key each session. If this is your first time logging into the server with a password, you may also need to change the root password. Follow the instructions to change the password if you receive a prompt.
The root user is the administrative user in a Linux environment with elevated privileges. Because of the heightened privileges of the root account, you are discouraged from using it regularly. The root account can make very destructive changes, even by accident.
The next step is setting up a new user account with reduced privileges for day-to-day use. Later, we’ll show you how to temporarily gain increased privileges for the times when you need them.
Once you log in as root, you’ll be able to add the new user account. In the future, we’ll log in with this new account instead of root.
This example creates a new user called sammy, but you should replace that with a username that you like:
- adduser sammy
You will be asked a few questions, starting with the account password.
Enter a strong password and, optionally, fill in any additional information you would like. This information is not required, and you can press ENTER
in any field you wish to skip.
Now you have a new user account with regular account privileges. However, you will sometimes need to perform administrative tasks as the root user.
To avoid logging out of your regular user and logging back in as the root account, you can set up what is known as superuser or root privileges for your user’s regular account. These privileges will allow your normal user to run commands with administrative privileges by putting the word sudo
before the command.
To add these privileges to your new user, you will need to add the user to the sudo system group. By default on Ubuntu, users who are members of the sudo group are allowed to use the sudo
command.
As root, run this command to add your new user to the sudo group (substitute the highlighted sammy
username with your new user):
- usermod -aG sudo sammy
You can now type sudo
before commands to run them with superuser privileges when logged in as your regular user.
Ubuntu servers can use the UFW firewall to ensure only connections to certain services are allowed. You can set up a basic firewall using this application.
Note: If your servers are running on DigitalOcean, you can optionally use DigitalOcean Cloud Firewalls instead of the UFW firewall. We recommend using only one firewall at a time to avoid conflicting rules that may be difficult to debug.
Applications can register their profiles with UFW upon installation. These profiles allow UFW to manage these applications by name. OpenSSH, the service that allows you to connect to your server, has a profile registered with UFW.
You can examine the list of installed UFW profiles by typing:
- ufw app list
OutputAvailable applications:
OpenSSH
You will need to make sure that the firewall allows SSH connections so that you can log into your server next time. Allow these connections by typing:
- ufw allow OpenSSH
Now enable the firewall by typing:
- ufw enable
Type y
and press ENTER
to proceed. You can see that SSH connections are still allowed by typing:
- ufw status
OutputStatus: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
The firewall is currently blocking all connections except for SSH. If you install and configure additional services, you will need to adjust the firewall settings to allow the new traffic into your server. You can learn some common UFW operations in our UFW Essentials guide.
Now that you have a regular user for daily use, you will need to make sure that you can SSH into the account directly.
Note: Until verifying that you can log in and use sudo
with your new user, we recommend staying logged in as root. If you have problems connecting, you can troubleshoot and make any necessary changes as root. If you use a DigitalOcean Droplet and experience problems with your root SSH connection, you can regain access to Droplets using the Recovery Console.
Configuring SSH access for your new user depends on whether your server’s root account uses a password or SSH keys for authentication.
If you logged in to your root account using a password then password authentication is enabled for SSH. You can SSH to your new user account by opening up a new terminal session and using SSH with your new username:
- ssh sammy@your_server_ip
After entering your regular user’s password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo
before it like this:
- sudo command_to_run
You will receive a prompt for your regular user’s password when using sudo
for the first time each session (and periodically afterward).
To enhance your server’s security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on Ubuntu to learn how to configure key-based authentication.
If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. To log in as your regular user with an SSH key, you must add a copy of your local public key to your new user’s ~/.ssh/authorized_keys
file.
Since your public key is already in the root account’s ~/.ssh/authorized_keys
file on the server, you can copy that file and directory structure to your new user account using your current session.
The simplest way to copy the files with the correct ownership and permissions is with the rsync
command. This command will copy the root user’s .ssh
directory, preserve the permissions, and modify the file owners, all in a single command. Make sure to change the highlighted portions of the command below to match your regular user’s name:
Note: The rsync
command treats sources and destinations that end with a trailing slash differently than those without a trailing slash. When using rsync
below, ensure that the source directory (~/.ssh
) does not include a trailing slash (check to make sure you are not using ~/.ssh/
).
If you accidentally add a trailing slash to the command, rsync
will copy the contents of the root account’s ~/.ssh
directory to the sudo
user’s home directory instead of copying the entire ~/.ssh
directory structure. The files will be in the wrong location and SSH will not be able to find and use them.
- rsync --archive --chown=sammy:sammy ~/.ssh /home/sammy
Now, open up a new terminal session on your local machine, and use SSH with your new username:
- ssh sammy@your_server_ip
You should be connected to your server with the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo
before the command like this:
- sudo command_to_run
You will be prompted for your regular user’s password when using sudo
for the first time each session (and periodically afterward).
At this point, you have a solid foundation for your server. You can install any of the software you need on your server now.
If you’d like to get more familiar with Linux commands, you can check our Linux Command Line Primer.
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
This curriculum introduces open-source cloud computing to a general audience along with the skills necessary to deploy applications and websites securely to the cloud.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Sign up for Infrastructure as a Newsletter.
Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
Excellent guide and what a well designed and functioning site UI/UX 5 *****
I am new to Django and have tried deploying my first project here in Digital Ocean. I followed this article for the steps and my website behaved as expected but when I integrated nginx setup, the static files are not showing up.
My
settings.py
has this:My
/etc/nginx/sites-available/digital_project
has this:my static folders (css, js,img) are in this path:
/home/djangoadmin/pyapps/digitalnotebook_project/static/
I read all the comments that you have here and tried a few (i.e granting permission) but to no avail. I hope someone can help me get this project finally working.
This comment has been deleted
Step 4: OpenSSH is not available in Ubuntu on WSL (Windows subsystem for Linux) I am using Ubuntu 22 on WSL on Win 11.
how can one find ‘your_server_ip’?
I absolutely love these types of articles! Thank you for taking the time to write the article and to keep the inform update to date.
Hey @jamonation, there is a typo on the page:
I had to restart the server for Step 3 to take effect.
I have made a bash script to automate the setup process, hopefully this will be useful to someone else.