Requirements
- A REGTR cloud server (Ubuntu 24.04)
- An SSH key on your computer (if not: ssh-keygen -t ed25519)
Steps
-
1Update the system
Log in as root and update packages.
apt update && apt -y upgrade -
2Create a sudo user
Use a privileged user instead of root for daily work. Your SSH key is copied to the new user.
adduser deploy usermod -aG sudo deploy rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy -
3Disable SSH password login
Allow key-based login only. Before closing your current session, confirm in a new terminal that you can log in as deploy.
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf >/dev/null <<'EOF' PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no EOF sudo sshd -t && sudo systemctl reload ssh -
4Enable the firewall (UFW)
Keep only SSH, HTTP and HTTPS open. The REGTR panel firewall allows the same ports by default; both work together.
sudo ufw allow OpenSSH sudo ufw allow 80,443/tcp sudo ufw enable sudo ufw status -
5Install fail2ban
Automatically bans IP addresses with repeated failed SSH logins.
sudo apt install -y fail2ban sudo systemctl enable --now fail2ban sudo fail2ban-client status sshd -
6Automatic security updates
Let security patches install themselves.
sudo apt install -y unattended-upgrades sudo dpkg-reconfigure -plow unattended-upgrades
Tips
- If you lose SSH access, use the VNC console in the panel or reset the root password.
- Take a snapshot in the panel before big changes; roll back in minutes if something breaks.
- If you use Docker, published ports bypass UFW; bind internal services to 127.0.0.1 (see the Docker guide).
FAQ
Do I need to change the SSH port?
Not required. With password login disabled and fail2ban running, changing the port only reduces log noise. If you change it, open the new port in UFW and the panel firewall.
Should root login be disabled completely?
In this guide root can only log in with a key (prohibit-password). To disable it entirely use PermitRootLogin no, after confirming sudo works for the deploy user.
Updated: 2026-10-23