Sakura VPS (Ubuntu 24.04) Initial Setup: Updates, SSH Keys, Firewall

This article is a localized edition of the Japanese original. Read the Japanese original

This article walks through the minimum setup to do right after installing Ubuntu as the standard OS on Sakura VPS (a VPS service from the Japanese hosting company Sakura Internet). Everything was checked against the Sakura VPS manual and Ubuntu 24.04 as of November 2026. The standard OS options include Ubuntu 22.04 / 24.04 / 26.04, and the steps are almost the same on 22.04 and later.

What to know first (Sakura VPS Ubuntu specifics)

According to the "Ubuntu 24.04" page of the Sakura VPS manual, the standard-OS Ubuntu is set up as follows.

Do root-level work by logging in as the ubuntu user and prefixing commands with sudo.

Step 1: Log in over SSH

Connect as the ubuntu user to the IP address (or the server's host name) shown in the control panel.

ssh ubuntu@203.0.113.10

On Windows 10/11 you can connect with the same command from PowerShell or Terminal.

Step 2: Update packages

sudo apt update
sudo apt upgrade -y

If an update (for example to the kernel) needs a reboot, the file /var/run/reboot-required is created. If it exists, reboot.

ls /var/run/reboot-required && sudo reboot

Do this regularly, not just the first time.

Step 3: Create a working user (optional)

You can keep using the ubuntu user. If you prefer to work as a user with your own name, create it and add it to the sudo group.

sudo adduser taro
sudo usermod -aG sudo taro

adduser asks for a password along the way, so set it there (you do not need to run passwd separately). The owner of the home directory is also set automatically.

Log in over SSH as the new user and confirm that sudo whoami returns root before moving on.

Step 4: Make SSH key-only

If password login stays allowed, the server is a target for brute-force attacks. Switch to key authentication.

Create and install a key

Create a key on your PC and install it on the server (if ssh-copy-id is not available on Windows, see How to manage SSH keys safely).

ssh-keygen -t ed25519
ssh-copy-id ubuntu@203.0.113.10
ssh ubuntu@203.0.113.10     # if you get in without a password prompt, the key is installed

Turn off password authentication

Work with your current SSH session left open. If you get a setting wrong, you can fix it from that session. On Sakura VPS you can also work from the console in the control panel.

Ubuntu's sshd reads /etc/ssh/sshd_config.d/*.conf at the top of /etc/ssh/sshd_config, and for any setting the first value read wins. That is why appending to the end of sshd_config may have no effect. Put your settings in sshd_config.d, in a file whose name sorts before any existing files.

ls /etc/ssh/sshd_config.d/
sudoedit /etc/ssh/sshd_config.d/01-hardening.conf

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no

Check the syntax and the values that actually take effect, then restart. On Ubuntu the service is called ssh (not sshd).

sudo sshd -t
sudo sshd -T | grep -Ei 'passwordauthentication|kbdinteractive|permitrootlogin'
sudo systemctl restart ssh

From another terminal, confirm that a connection without a key is refused.

ssh -o PubkeyAuthentication=no ubuntu@203.0.113.10
# Success if you see Permission denied (publickey).

Changing the SSH port on Ubuntu 24.04 requires editing ssh.socket because of socket activation, and you would also have to allow the new port again in the Sakura VPS packet filter. The manual also notes that a port change is not a real defense, since scans find the new port. Make key-only login your first priority.

Step 5: Decide on a firewall (packet filter or UFW)

Sakura VPS has a "packet filter" that restricts traffic outside the server (configured in the control panel). Inside the server you can also use UFW (Ubuntu's firewall).

If you restrict traffic in both, it takes more effort to find which one is blocking a connection that does not work. The manual also says that when you use the OS firewall, you should set the packet filter to not be used. Deciding to manage things mainly in one of them makes administration easier.

Managing with the packet filter

If you will publish a website, open the packet filter settings for the server in the control panel and add "Web" (TCP 80/443) in addition to SSH. Without it, your site cannot be reached from outside even if a web server is running on the server.

Managing with UFW

Allow SSH before enabling it. If you do it the other way round, your connection drops on the spot.

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

When ufw enable warns that it may disrupt existing SSH connections, type y. If OpenSSH is already allowed, your connection stays up.

For more on configuring UFW, see How to set up a firewall with UFW.

Step 6: Install fail2ban (optional)

fail2ban blocks sources that keep failing to log in for a set period. With key-only SSH, the risk of a break-in is already much lower, but fail2ban cuts down log volume and unwanted connections.

sudo apt install -y fail2ban
sudo fail2ban-client status sshd

The Ubuntu 24.04 package installs with SSH monitoring (the [sshd] jail) enabled in /etc/fail2ban/jail.d/defaults-debian.conf. If the command above shows a status such as Currently banned, it is working. To change the number of failures or the ban time, create /etc/fail2ban/jail.local and override the settings there (do not edit jail.conf directly).

Step 7: Other settings as needed

• Japanese messages: The default is C.UTF-8, so messages are in English. If you want them in Japanese, install language-pack-ja and change the locale with localectl set-locale.
• Swap: There is no swap by default. If you run WordPress or MySQL on a plan with little memory, consider creating a swap file.
• Automatic updates: Ubuntu's unattended-upgrades package can apply security updates automatically. Check whether it is installed with systemctl status unattended-upgrades, and if not, install it with sudo apt install unattended-upgrades.

Initial setup checklist

• Ran sudo apt update && sudo apt upgrade and rebooted if needed
• Can log in with a key, and ssh -o PubkeyAuthentication=no is refused
• Confirmed passwordauthentication no with sshd -T
• Decided whether to manage with the packet filter or UFW, and allowed SSH and (if publishing a site) 80/443
• If using fail2ban, confirmed it works with fail2ban-client status sshd

Once the server is in this state, move on to installing a web server and WordPress. For SSH settings in general, see also SSH security settings.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)