Cloud servers from $4/mo - Grab the Deal! Let’s start ->
How to Configure Uncomplicated Firewall (UFW) on Ubuntu 24.04
Ubuntu
Firewall
21.08.2024
Reading time: 8 min
Share
Setting up a firewall is one of the fundamental steps in safeguarding an Ubuntu 24.04 installation. Security is an important part of running any server or system. A firewall restricts which services are permitted to communicate with the server, thus acting as a barrier between the system and any potential threats. On Ubuntu, the Uncomplicated Firewall (UFW) offers an intuitive frontend for controlling firewall rules. It makes setting up iptables, the robust but intricate underlying firewall mechanism, easier. UFW makes it simple to set up and manage their firewall settings, even if they have little experience with networking concepts. This increases system security without requiring a high level of technical expertise. With the help of this article, you will be able to install, configure, and manage UFW on Ubuntu 24.04, protecting the server from undesirable network traffic while maintaining the seamless operation of authorized services.
Hostman offers a cloud managed firewall that provides cutting-edge defense tailored for businesses of all sizes.
Prerequisites
- A local computer or a cloud server with Ubuntu 24.04 installed
- Root access or user with
sudoprivileges
Installing UFW
On Ubuntu 24.04, installing the Uncomplicated Firewall (UFW) is straightforward. Normally, Ubuntu has it pre-installed, but if it's not, one may easily install it on the machine by following the instructions below:
-
Update the package lists to ensure to have the most recent information on package versions and dependencies. Run the command below:
sudo apt update && sudo apt upgrade -y-
The below command can be used to install UFW on the machine.
sudo apt install ufw -y-
Once installation is complete, the default status of UFW is inactive. Check it using the command below:
sudo ufw status
Enabling UFW
You must enable UFW beforehand to begin securing the system. When UFW is enabled, it will begin enforcing both its default rules and any custom rules that have been established. If you are configuring a remote server, make sure to allow SSH connections before starting UFW, to avoid locking users out. Now that UFW is installed and operational, you can start creating firewall rules that meet the unique security needs.
Enable UFW using the command below and type "y" to proceed.
sudo ufw enable
Allowing SSH Connections
Enabling the firewall before enabling SSH connections is crucial when deploying UFW on a server, particularly if if administering it remotely over SSH. SSH blocking may prevent you from accessing the server and render it unusable.
On Ubuntu 24.04, you can enable SSH connections by following these steps:
- It is easy to permit SSH traffic using UFW. Use the following command to enable it.
sudo ufw allow ssh
- To confirm that the rule was successfully added, check the status of UFW by running thecommand below.
sudo ufw status
- If the SSH service is operating on a non-standard port, you can choose that port instead of the default by issuing the following command.
sudo ufw allow <custom_port>/tcpUnderstanding UFW Default Policies
It's critical to learn about the default policies that UFW applies to incoming, outgoing, and forwarded traffic before digging into custom firewall rules. These default policies provide the firewall's baseline behavior, which can subsequently be adjusted with particular rules to permit or prohibit particular kinds of traffic.
-
UFW prevents all incoming connections to the server by default. This security precaution keeps unwanted users from accessing the system. Any request that comes in from outside the system will be rejected unless a particular rule is configured to authorize it. Requests for SSH, FTP, HTTP, and HTTPS are included in this.
-
By default, UFW permits all outgoing connections. This implies that there are no restrictions on the connections the server can make to other servers or services. Because outgoing traffic is normally safe, this policy allows the server to access the internet, download updates, and connect to other services without requiring any additional settings.
-
Since UFW's default forwarding policy is set to refuse, all forwarded traffic is blocked. Packets that are received by the firewall and subsequently forwarded to a different location are referred to as forwarded traffic. This is especially important for systems that serve as gateways or routers. The server must modify this policy if it is intended to forward traffic between networks.
Allowing and Denying Specific Ports and Services
The ability of UFW to simply control which ports and services are granted or denied access to the system is one of its main features. This feature is necessary to secure the Ubuntu 24.04 server and manage traffic. Using UFW, you can use this method to enable or block particular ports and services.
- To enable traffic on a specific port, run the
ufw allowcommand followed by the port number. In this example, to allow http (port 80), run the command below.
sudo ufw allow 80/tcp
- To allow https (port 443), run the command below.
sudo ufw allow 443/tcp
- If a non-standard port is used by the application, the port can also specify using the command below.
sudo ufw allow <custom_port>/tcpFor example:
sudo ufw allow 3026/tcp
Traffic on port 3026, which is frequently used for database configurations, is now permitted.
- Likewise, in order to prevent access, you can restrict traffic on a particular port, run the command below.
sudo ufw deny 80/tcp
Checking UFW Status and Rules
After configuring Ubuntu 24.04's UFW (Uncomplicated Firewall), it's critical to frequently check the firewall's status and go over the rules that have been set up. By doing this, you can be sure the firewall is up and running as it should. To inspect the current firewall rules and verify the status of UFW, run the following command:
sudo ufw status
Managing UFW Application Profiles
Predefined application profiles included in Ubuntu 24.04's UFW (Uncomplicated Firewall) make it easier to grant or restrict traffic for particular services. Firewall management is made easier by these profiles, which include preconfigured rules for popular services including SSH, POSTIFX, OPENSSH, HTTP, HTTPS, and others. Managing UFW application profiles can be done as follows.
- Use the following command to view every application profile that is available on the system.
sudo ufw app list
- Use the below command to view the rules included in a particular application profile. The ports and protocols that the profile controls will be displayed in the output.
sudo ufw app info <application_name>For example:
sudo ufw app info OpenSSH
- The application profile that you wish to use can be allow with UFW once it has been identified. For instance, use the following command to enable HTTP traffic.
sudo ufw allow http
- Likewise, the deny command can be used to prevent traffic for a certain application profile. For example, use the following command to stop all communication related to the HTTP.
sudo ufw deny http
- If a rule related to an application profile is no longer required, it can be deleted using the following command:
sudo ufw delete allow http
Disabling UFW
Even though Ubuntu 24.04's UFW (Uncomplicated Firewall) is an effective tool for controlling firewall rules and system security, there may be circumstances in which it needs to be turned off, either permanently or temporarily. Unless another firewall or security solution is in place, disabling UFW will halt the firewall and erase all active rules, leaving the system unsecured.
- To disable UFW, run the below command. By using this command, you can successfully turn off the firewall and stop the UFW service.
sudo ufw disable
- Use the command below to verify that UFW has been successfully disabled. The status output should show below.
sudo ufw status
Troubleshooting Common Issues
Although UFW (Uncomplicated Firewall) is meant to be user-friendly, there could be some problems with installation or firewall rule management. Here are some typical issues that may run into and solutions for issues.
-
If UFW is not listed on the installed packed, try reinstalling it by running
sudo apt updateandsudo apt install ufwrespectively. -
If the installation fails to install, look for issues in your sources or package management. You can also try
apt updateandapt clean. -
Conflicting firewall service. Before activating UFW, make sure that all other firewall services, such as firewall and iptables, have been stopped and deactivated. For further information, review the UFW logs if the issue continues. Useful command is
sudo tail -f /var/log/ufw.log. -
Once UFW is enabled, you cannot connect remotely to the server and SSH access is restricted. If the you are locked out due to UFW blocking SSH, you need to access the server on the console and run command
sudo ufw allow sshto regain access.
Conclusion
In conclusion, one of the most important steps in protecting Ubuntu 24.04 is configuring the Uncomplicated Firewall (UFW), which controls inbound and outbound network traffic. Because of its intuitive interface, UFW makes firewall control simple enough even for individuals with little experience with Linux system administration. You can effectively control traffic to and from the server by following the instructions to install UFW, create default policies, allow or deny certain ports and services, and manage application profiles. Monitoring the firewall rules and UFW status on a regular basis guarantee that the system is always shielded from unwanted access. Whether it's administering a production environment or protecting a personal server, UFW offers a reliable and simple way to improve the security of the system. By adding the capability to diagnose common problems, one can keep the firewall configuration secure and effective for what is needed.
Ubuntu
Firewall
21.08.2024
Reading time: 8 min
Share
Similar
Wordpress
How to Install WordPress with Nginx and Let’s Encrypt SSL on Ubuntu
WordPress is a simple, popular, open-source, and free CMS (content management system) for creating modern websites. Today, WordPress powers nearly half of the websites worldwide. Hostman offers Wordpress cloud hosting with quick load times, robust security, and simplified management.
However, having just a content management system is not enough. Modern websites require an SSL certificate, which provides encryption and allows using a secure HTTPS connection.
This short guide will show how to install WordPress on a cloud server, perform initial CMS configuration, and add an SSL certificate to the completed site, enabling users to access the website via HTTPS.
The Nginx web server will receive user requests and then proxied to WordPress for processing and generating response content.
A few additional components are also needed: a MySQL database, which serves as the primary data storage in WordPress, and PHP, which WordPress is written in.
This technology stack is known as LEMP: Linux, Nginx, MySQL, PHP.
Step 1. Creating the Server
First, you will need a cloud server with Ubuntu 22.04 installed.
Go to the Hostman control panel.
Select the Cloud servers tab on the left side of the control panel.
Click the Create button.
You’ll need to configure a range of parameters that ultimately determine the server rental cost. The most important of these parameters are:
The operating system distribution and its version (in our case, Ubuntu 22.04).
Data center location.
Physical configuration.
Server information.
Once all the data is filled in, click the Order button.
Upon completion of the server setup, you can view the IP address of the cloud server in the Dashboard tab, and also copy the command for connecting to the server via SSH along with the root password:
Next, open a terminal in your local operating system and connect via SSH with password authentication:
ssh root@server_ip
Replace server_ip with the IP address of your cloud server. You will then be prompted to enter the password, which you can either type manually or paste from the clipboard.
After connecting, the terminal will display information about the operating system. Now you can create a user with sudo priviliges or keep using root.
Step 2. Updating the System
Before beginning the WordPress installation, it’s important to update the list of repositories available through the APT package manager:
sudo apt update -y
It’s also a good idea to upgrade already installed packages to their latest versions:
sudo apt upgrade -y
Now, we can move on to downloading and installing the technology stack components required for running WordPress.
Step 3. Installing PHP
Let's download and install the PHP interpreter.
First, add a specialized repository that provides up-to-date versions of PHP:
sudo add-apt-repository ppa:ondrej/php
In this guide, we are using PHP version 8.3 in FPM mode (FastCGI Process Manager), along with an additional module to enable PHP’s interaction with MySQL:
sudo apt install php8.3-fpm php-mysql -y
The -y flag automatically answers “yes” to any prompts during the installation process.
To verify that PHP is now installed on the system, you can check its version:
php -v
The console output should look like this:
PHP 8.3.13 (cli) (built: Oct 30 2024 11:27:41) (NTS)Copyright (c) The PHP GroupZend Engine v4.3.13, Copyright (c) Zend Technologies with Zend OPcache v8.3.13, Copyright (c), by Zend Technologies
You can also check the status of the FPM service:
sudo systemctl status php8.3-fpm
In the console output, you should see a green status indicator:
Active: active (running)
Step 4. Installing MySQL
The MySQL database is an essential component of WordPress, as it stores all site and user information for the CMS.
Installation
We’ll install the MySQL server package:
sudo apt install mysql-server -y
To verify the installation, check the database version:
mysql --version
If successful, the console output will look something like this:
mysql Ver 8.0.39-0ubuntu0.22.04.1 for Linux on x86_64 ((Ubuntu))
Also, ensure that the MySQL server is currently running by checking the database service status:
sudo systemctl status mysql
The console output should display a green status indicator:
Active: active (running)
MySQL Security
This step is optional in this guide, but it’s worth mentioning. After installing MySQL, you can configure the database’s security settings:
mysql_secure_installation
This command will prompt a series of questions in the terminal to help you configure the appropriate level of MySQL security.
Creating a Database
Next, prepare a dedicated database specifically for WordPress.
First, log in to MySQL:
mysql
Then, execute the following SQL command to create a database:
CREATE DATABASE wordpress_database;
You’ll also need a dedicated user for accessing this database:
CREATE USER 'wordpress_user'@'localhost' IDENTIFIED BY 'wordpress_password';
Grant this user the necessary access permissions:
GRANT ALL PRIVILEGES ON wordpress_database.* TO 'wordpress_user'@'localhost';
Finally, exit MySQL:
quit
Step 5. Downloading and Configuring Nginx
The Nginx web server will handle incoming HTTP requests from users and proxy them to PHP via the FastCGI interface.
Download and Installation
We’ll download and install the Nginx web server using APT:
sudo apt install nginx -y
Next, verify that Nginx is indeed running as a service:
systemctl status nginx
In the console output, you should see a green status indicator:
Active: active (running)
You can also check if the web server is functioning correctly by making an HTTP request through a browser. Enter the IP address of the remote server in the address bar, where you are installing Nginx. For example:
http://166.1.227.189
If everything is set up correctly, Nginx will display its default welcome page.
For good measure, let’s add Nginx to the system’s startup list (though this is typically done automatically during installation):
sudo systemctl enable nginx
Now, you can proceed to make adjustments to the web server configuration.
Configuration
In this example, we’ll slightly modify the default Nginx configuration. For this, we need a text editor. We will use nano.
sudo apt install nano
Now open the configuration file:
sudo nano /etc/nginx/sites-enabled/default
If you remove all the comments, the basic configuration will look like this:
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
try_files $uri $uri/ =404;
}
}
To this configuration, we’ll add the ability to proxy requests to PHP through FastCGI:
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
# added index.php to index files
index index.html index.htm index.nginx-debian.html index.php;
# specify the domain name to obtain an SSL certificate later
server_name mydomain.com www.mydomain.com;
location / {
# try_files $uri $uri/ =404;
# direct root requests to /index.php
try_files $uri $uri/ /index.php?$args;
}
# forward all .php requests to PHP via FastCGI
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}
Note that the server_name parameter should contain the domain name, with DNS settings including an A record that directs to the configured server with Nginx.
Now, let’s check the configuration syntax for errors:
sudo nginx -t
If everything is correct, you’ll see a confirmation message in the console:
nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successful
Then, reload the Nginx service to apply the new configuration:
sudo systemctl reload nginx
Step 6. Installing an SSL Certificate
To obtain an SSL certificate from Let’s Encrypt, we’ll use a special utility called Certbot. In this guide, Certbot will automate several tasks:
Request the SSL certificate.
Create an additional Nginx configuration file.
Edit the existing Nginx configuration file (which currently describes the HTTP server setup).
Restart Nginx to apply the changes.
Obtaining the Certificate
Like other packages, install Certbot via APT:
sudo apt install certbotsudo apt install python3-certbot-nginx
The first command installs Certbot, and the second adds a Python module for Certbot’s integration with Nginx. Alternatively, you can install python3-certbot-nginx directly, which will automatically include Certbot as a dependency:
sudo apt install python3-certbot-nginx -y
Now, let’s initiate the process to obtain and install the SSL certificate:
sudo certbot --nginx
First, Certbot will prompt you to register with Let’s Encrypt. You’ll need to provide an email address, agree to the Terms of Service, and optionally opt-in for email updates (you may decline this if desired).
Then, enter the list of domain names, separated by commas or spaces, for which the certificate should be issued. Specify the exact domain names that are listed in the Nginx configuration file under the server_name directive:
mydomain.com
www.mydomain.com
After the certificate is issued, Certbot will automatically configure it by adding the necessary SSL settings to the Nginx configuration file:
listen 443 ssl; # managed by Certbot
# RSA certificate
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
# Redirect non-https traffic to https
if ($scheme != "https") {
return 301 https://$host$request_uri;
} # managed by Certbot
So, the complete Nginx configuration file will look as follows:
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl; # managed by Certbot
# RSA certificate
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
root /var/www/html;
index index.html index.htm index.nginx-debian.html index.php;
server_name domain.com www.domain.com;
# Redirect non-https traffic to https
if ($scheme != "https") {
return 301 https://$host$request_uri;
} # managed by Certbot
location / {
# try_files $uri $uri/ =404;
# direct root requests to /index.php
try_files $uri $uri/ /index.php?$args;
}
# forward all .php requests to PHP via FastCGI
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}
Automatic Certificate Renewal
Let’s Encrypt certificates expire every 90 days, so they need to be renewed regularly. Instead of manually renewing them, you can set up an automated task.
For this purpose, we’ll use Crontab, a scheduling tool in Unix-based systems that uses a specific syntax to define when commands should run.
Install Crontab:
sudo apt install cron
And enable it:
sudo systemctl enable cron
Now open the Crontab file:
crontab -e
Add the following line to schedule the Certbot renewal command:
0 12 * * * /usr/bin/certbot renew --quiet
In this configuration:
The command runs at noon (12:00) every day.
Certbot will check the certificate’s expiration status and renew it if necessary.
The --quiet flag ensures that Certbot runs silently without generating output.
Step 7. Downloading WordPress
In this guide, we’ll use WordPress version 6.5.3, which can be downloaded from the official website:
wget https://wordpress.org/wordpress-6.5.3.tar.gz
Once downloaded, unpack the WordPress archive:
tar -xvf wordpress-*.tar.gz
After unpacking, you can delete the archive file:
rm wordpress-*.tar.gz
This will create a wordpress folder containing the WordPress files.
Most core files are organized in the wp-content, wp-includes, and wp-admin directories. The main entry point for WordPress is index.php.
Moving WordPress Files to the Web Server Directory
You need to copy all files from the wordpress folder to the web server’s root directory (/var/www/html/) so that Nginx can serve the PHP-generated content based on user HTTP requests.
Clear the existing web server directory (as it currently contains only the default Nginx welcome page, which we no longer need):
rm /var/www/html/*
Copy WordPress files to the web server directory:
cp -R wordpress/* /var/www/html/
The -R flag enables recursive copying of files and folders.
Set ownership and permissions. Ensure that Nginx can access and modify these files by setting the www-data user and group ownership, as well as appropriate permissions, for the WordPress directory:
sudo chown -R www-data:www-data /var/www/html/sudo chmod -R 755 /var/www/html/
This allows Nginx to read, write, and modify WordPress files as needed, avoiding permission errors during the WordPress installation process.
Step 8. Configuring WordPress
WordPress configuration is managed through an intuitive web-based admin panel. No programming knowledge is necessary, though familiarity with languages like JavaScript, PHP, HTML, and CSS can be helpful for creating or customizing themes and plugins.
Accessing the Admin Panel
Open a web browser and go to the website using the domain specified in the Nginx configuration, such as:
https://mydomain.com
If all components were correctly set up, you should be redirected to WordPress’s initial configuration page:
https://mydomain.com/wp-admin/setup-config.php
Select Language: Choose your preferred language and click Continue.
Database Configuration: WordPress will prompt you to enter database details. Click Let’s go! and provide the following information:
Database Name: wordpress_database (from the previous setup)
Database Username: wordpress_user
Database Password: wordpress_password
Database Host: localhost
Table Prefix: wp_ (or leave as default)
Click Submit. If the credentials are correct, WordPress will confirm access to the database.
Run Installation: Click Run the installation. WordPress will then guide you to enter site and admin details:
Site Title
Admin Username
Admin Password
Admin Email
Option to discourage search engine indexing (recommended for development/testing sites)
Install WordPress: Click Install WordPress. After installation, you’ll be prompted to log in with the admin username and password you created.
Accessing the Dashboard
Once logged in, you'll see the WordPress Dashboard, which contains customizable widgets. The main menu on the left allows access to core WordPress functions, including:
Posts and Pages for content creation
Comments for moderating discussions
Media for managing images and files
Themes and Plugins for design and functionality
Users for managing site members and roles
Your WordPress site is now fully configured, and you can begin customizing and adding content as needed.
Conclusion
This guide showed how to install WordPress along with all its dependencies and how to connect a domain and add a SSL certificate from Let’s Encrypt to an already functioning website, enabling secure HTTPS connections with the remote server.
The key dependencies required for WordPress to function include:
PHP: The scripting language WordPress is written in.
MySQL: The database system used by WordPress to store content and user data.
Nginx (or Apache in other implementations): The web server that processes user requests initially.
For more detailed information on managing site content through the WordPress admin panel, as well as creating custom themes and plugins, refer to the official WordPress documentation.
Frequently Asked Questions
How do I install WordPress on Ubuntu?
First set up Nginx, PHP, and MySQL. Then either download WordPress manually or use a deployment script.
How do I enable HTTPS with Let’s Encrypt?
Use Certbot to generate a certificate, then automate renewal with a simple cron job.
Is Nginx better than Apache for WordPress?
For performance and memory efficiency, yes. Nginx handles high traffic with fewer resources.
16 June 2025 · 13 min to read
Ubuntu
How to Install and Configure SSH on Ubuntu 22.04
SSH is a network protocol that provides a secure connection between a client and a server. All communication is encrypted, preventing theft of data transmitted over the network and other remote network attacks.
Let’s say you have ordered a cloud server from Hostman. You will need SSH installed and configured to connect to and administer the server.
The guide below will describe how to install SSH on Ubuntu 22.04 and configure it.
Prerequisites
Before proceeding with the installation and configuration of the Secure Shell service, ensure the following requirements are met:
Linux Command Line Skills for Configuration
Having a solid grasp of basic Linux commands like sudo, apt, nano, and systemctl is essential when setting up the service. These commands will be frequently used during the installation and configuration process. It's crucial to be comfortable working within the command line environment to manage the service effectively.
Root or Sudo Access for Setup
To install and configure the server, administrative (root) privileges are required. Users must either have sudo access or be logged in as root. Without these privileges, the setup process cannot proceed.
Internet Connection for Package Download
A stable internet connection is necessary to install the OpenSSH server and any additional related packages. Without a functional connection, the system cannot retrieve the required software components.
Configuring Firewall for Access
If a firewall, like ufw, is enabled on the system, it may block remote access by default. It is essential to configure your firewall to allow incoming connections. Use ufw or another firewall tool to ensure port 22 is open and accessible.
Access to the System (Local or Remote)
You need physical access to your machine to configure the service locally, or it must be remotely accessible via its IP address. Ensure the system is properly connected to the network to establish a connection.
Don't forget, that you can deploy your cloud server fast and cheap by choosing our VPS Server Hosting
Step 1: Prepare Ubuntu
The first thing you need to do before you start installing SSH on Ubuntu is to update all apt packages to the latest versions. To do this, use the following command:
sudo apt update && sudo apt upgrade
Step 2: Install SSH on Ubuntu
OpenSSH is not pre-installed on the system, so let's install it manually. To do this, type in the terminal:
sudo apt install openssh-server
The installation of all the necessary components will begin. Answer "Yes" to all the system prompts.
After the installation is complete, go to the next step to start the service.
Step 3: Start SSH
Now you need to enable the service you just installed using the command below:
sudo systemctl enable --now ssh
On successful startup, you will see the following system message.
The --now key helps you launch the service and simultaneously set it to start when the system boots.
To verify that the service is enabled and running successfully, type:
sudo systemctl status ssh
The output should contain the Active: active (running) line, which indicates that the service is successfully running.
If you want to disable the service, execute:
sudo systemctl disable ssh
It disables the service and prevents it from starting at boot.
Step 4: Configure the firewall
Before connecting to the server via SSH, check the firewall to ensure it is configured correctly.
In our case, we have the UFW installed, so we will use the following command:
sudo ufw status
In the output, you should see that SSH traffic is allowed. If you don't have it listed, you need to allow incoming SSH connections. This command will help with this:
sudo ufw allow ssh
Step 5: Connect to the server
Once you complete all the previous steps, you can log into the server using the SSH protocol.
To do this, you will need the server's IP address or domain name and the name of a user created on the server.
In the terminal line, enter the command:
ssh username@IP_address
Or:
ssh username@domain
Important: To successfully connect to a remote server, SSH must be installed and configured on the remote server and the user's computer from which you make the connection.
-
Step 6 (optional): Create Key Pair for Secure Authentication
For enhanced security, consider configuring a key pair instead of relying on password authentication. To generate one, use the following command:
ssh-keygen
Step 7: Configure SSH
Having completed the previous five steps, you can already connect to the server remotely. However, you can further increase the connection's security by changing the default connection port to another or changing the password authentication to key authentication. These and other changes require editing the SSH configuration file.
The main OpenSSH server settings are stored in the main configuration file sshd_config (location: /etc/ssh). Before you start editing, you should create a backup of this file:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.initial
If you get any errors after editing the configuration file, you can restore the original file without problems.
After creating the backup, you can proceed to edit the configuration file. To do this, open it using the nano editor:
sudo nano /etc/ssh/sshd_config
In the file, change the port to a more secure one. It is best to set values from the dynamic range of ports (49152 - 65535) and use different numbers for additional security. For example, let's change the port value to 49532. To do this, we uncomment the corresponding line in the file and change the port as shown in the screenshot below.
In addition to this setting, we recommend changing the password authentication mode to a more secure key authentication mode. To do this, uncomment the corresponding line and make sure the value is "Yes", as shown in the screenshot.
Now, let's prohibit logging on to the server as a superuser by changing the corresponding line as shown in the picture below.
There are other settings you can configure to increase the server security:
UseDNS checks if the hostname matches its IP address. The value "Yes" enables this parameter.
PermitEmptyPasswords prohibits using empty passwords for authentication if the value is "No."
MaxAuthTries limits the number of unsuccessful attempts to connect to the server within one communication session.
AllowUsers and AllowGroups are responsible for the list of users and groups allowed to access the server:
# AllowUsers User1, User2, User3# AllowGroups Group1, Group2, Group3
Login GraceTime sets the time provided for successful authorization. We recommend reducing the value of this parameter by four times.
ClientAliveInterval limits the time of user inactivity. After exceeding the specified limit, the user is disconnected.
After making all the changes in the main configuration file, save them and close the editor.
Restart the service to make the changes take effect:
sudo systemctl restart ssh
If you have changed the port in the configuration file, you should connect using the new port:
ssh -p port_number username@IP_address
Or:
ssh -p port_number_port_username@domain
Troubleshooting Connection Issues
Ensure the service is running with:
sudo systemctl status ssh
Restart it if necessary:
sudo systemctl restart ssh
Check firewall settings to allow traffic on port 22:
sudo ufw allow 22
Confirm the system is reachable by running:
ping <server-ip-address>
Disabling the Service
If you need to disable remote access for any reason, follow these steps:
Stop the Service
To temporarily stop accepting connections:
sudo systemctl stop ssh
Prevent Automatic Startup
To disable it from starting on reboot:
sudo systemctl disable ssh
Confirm Inactive Status
Verify that the service is no longer running:
sudo systemctl status ssh
Uninstall the Server
If the service is no longer needed, remove it and its associated configuration files:
sudo apt remove openssh-server
Conclusion
This article presents a step-by-step guide on installing and configuring SSH in Ubuntu 22.04 and describes how to edit the main configuration file to improve security. We hope this guide helps you to set up a secure remote connection to your Ubuntu server.To see more about SSH keys click here.
05 June 2025 · 7 min to read
Ubuntu
How to Install VNC on Ubuntu
If you need to interact with a remote server through a graphical interface, you can use VNC technology.VNC (Virtual Network Computing) allows users to establish a remote connection to a server over a network. It operates on a client-server architecture and uses the RFB protocol to transmit screen images and input data from various devices (such as keyboards or mice). VNC supports multiple operating systems, including Ubuntu, Windows, macOS, and others. Another advantage of VNC is that it allows multiple users to connect simultaneously, which can be useful for collaborative work on projects or training sessions.
In this guide, we will describe how to install VNC on Ubuntu, using a Hostman cloud server with Ubuntu 22.04 as an example.
Step 1: Preparing to Install VNC
Before starting the installation process on both the server and the local machine, there are a few prerequisites to review.
Here is a list of what you’ll need to complete the installation:
A Server Running Ubuntu 22.04. In this guide, we will use a cloud server from Hostman with minimal hardware configuration.
A User with sudo Privileges. You should perform the installation as a regular user with administrative privileges.
Select a Graphical Interface. You’ll need to choose a desktop environment that you will use to interact with the remote server after installing the system on both the server and the local machine.
A Computer with a VNC Client Installed.
Currently, the only way to communicate with a rented server running Ubuntu 22.04 is through the console. To enable remote management via a graphical interface, you’ll need to install a desktop environment along with VNC on the server. Below are lists of available VNC servers and desktop environments that can be installed on an Ubuntu server.
VNC Servers:
TightVNC Server. One of the most popular VNC servers for Ubuntu. It is easy to set up and offers good performance.
RealVNC Server. RealVNC provides a commercial solution for remote access to servers across various Linux distributions, including Ubuntu, Debian, Fedora, Arch Linux, and others.
Desktop Environments:
Xfce. A lightweight and fast desktop environment, ideal for remote sessions over VNC. It uses fewer resources than heavier desktop environments, making it an excellent choice for servers and virtual machines.
GNOME. The default Ubuntu desktop environment, offering a modern and user-friendly interface. It can be used with VNC but will consume more resources than Xfce.
KDE Plasma. Another popular desktop environment that provides a wide range of features and a beautiful design.
The choice of VNC server and desktop environment depends on the user’s specific needs and available resources. TightVNC and Xfce are excellent options for stable remote sessions on Ubuntu, as they do not require high resources. In the next step, we will describe how to install them on the server in detail.
Step 2: Installing the Desktop Environment and VNC Server
To install the VNC server on Ubuntu along with the desktop environment, connect to the server and log in as a regular user with administrative rights.
Update the Package List
After logging into the server, run the following command to update the packages from the connected repositories:
sudo apt update
Install the Desktop Environment
Next, install the previously selected desktop environment. To install Xfce, enter:
sudo apt install xfce4 xfce4-goodies
Here, the first package provides the basic Xfce desktop environment, while the second includes additional applications and plugins for Xfce, which are optional.
Install the TightVNC Server
To install TightVNC, enter:
sudo apt install tightvncserver
Start the VNC Server
Once the installation is complete, initialize the VNC server by typing:
vncserver
This command creates a new VNC session with a specific session number, such as :1 for the first session, :2 for the second, and so on. This session number corresponds to a display port (for example, port 5901 corresponds to :1). This allows multiple VNC sessions to run on the same machine, each using a different display port.
During the first-time setup, this command will prompt you to set a password, which will be required for users to connect to the server’s graphical interface.
Set the View-Only Password (Optional)
After setting the main password, you’ll be prompted to set a password for view-only mode. View-only mode allows users to view the remote desktop without making any changes, which is helpful for demonstrations or when limited access is needed.
If you need to change the passwords set above, use the following command:
vncpasswd
Now you have a VNC session.
In the next step, we will set up VNC to launch the Ubuntu server with the installed desktop environment.
Step 3: Configuring the VNC Server
The VNC server needs to know which desktop environment it should connect to. To set this up, we’ll need to edit a specific configuration file.
Stop Active VNC Instances
Before making any configurations, stop any active VNC server instances. In this guide, we’ll stop the instance running on display port 5901. To do this, enter:
vncserver -kill :1
Here, :1 is the session number associated with display port 5901, which we want to stop.
Create a Backup of the Configuration File
Before editing, it’s a good idea to back up the original configuration file. Run:
mv ~/.vnc/xstartup ~/.vnc/xstartup.bak
Edit the Configuration File
Now, open the configuration file in a text editor:
nano ~/.vnc/xstartup
Replace the contents with the following:
#!/bin/bashxrdb $HOME/.Xresourcesstartxfce4 &
#!/bin/bash – This line is called a "shebang," and it specifies that the script should be executed using the Bash shell.
xrdb $HOME/.Xresources – This line reads settings from the .Xresources file, where desktop preferences like colors, fonts, cursors, and keyboard options are stored.
startxfce4 & – This line starts the Xfce desktop environment on the server.
Make the Configuration File Executable
To allow the configuration file to be executed, use:
chmod +x ~/.vnc/xstartup
Start the VNC Server with Localhost Restriction
Now that the configuration is updated, start the VNC server with the following command:
vncserver -localhost
The -localhost option restricts connections to the VNC server to the local host (the server itself), preventing remote connections from other machines. You will still be able to connect from your computer, as we’ll set up an SSH tunnel between it and the server. These connections will also be treated as local by the VNC server.
The VNC server configuration is now complete.
Step 4: Installing the VNC Client and Connecting to the Server
Now, let’s proceed with installing a VNC client. In this example, we’ll install the client on a Windows 11 computer.
Several VNC clients support different operating systems. Here are a few options:
RealVNC Viewer. The official client from RealVNC, compatible with Windows, macOS, and Linux.
TightVNC Viewer. A free and straightforward VNC client that supports Windows and Linux.
UltraVNC. Another free VNC client for Windows with advanced remote management features.
For this guide, we’ll use the free TightVNC Viewer.
Download and Install TightVNC Viewer
Visit the official TightVNC website, download the installer, and run it.
In the installation window, click Next and accept the license agreement.
Then, select the custom installation mode and disable the VNC server installation, as shown in the image below.
Click Next twice and complete the installation of the VNC client on your local machine.
Set Up an SSH Tunnel for Secure Connection
To encrypt your remote access to the VNC server, use SSH to create a secure tunnel. On your Windows 11 computer, open PowerShell and enter the following command:
ssh -L 56789:localhost:5901 -C -N -l username server_IP_address
Make sure that OpenSSH is installed on your local machine; if not, refer to Microsoft’s documentation to install it.
This command configures an SSH tunnel that forwards the connection from your local computer to the remote server over a secure connection, making VNC believe the connection originates from the server itself. Here’s a breakdown of the flags used:
-L sets up SSH port forwarding, redirecting the local computer’s port to the specified host and server port. Here, we choose port 56789 because it is not bound to any service.
-C enables compression of data before transmitting over SSH.
-N tells SSH not to execute any commands after establishing the connection.
-l specifies the username for connecting to the server.
Connect with TightVNC Viewer
After creating the SSH tunnel, open the TightVNC Viewer and enter the following in the connection field:
localhost:56789
You’ll be prompted to enter the password created during the initial setup of the VNC server.
Once you enter the password, you’ll be connected to the VNC server, and the Xfce desktop environment should appear.
Stop the SSH Tunnel
To close the SSH tunnel, return to the PowerShell or command line on your local computer and press CTRL+C.
Conclusion
This guide has walked you through the step-by-step process of setting up VNC on Ubuntu 22.04. We used TightVNC Server as the VNC server, TightVNC Viewer as the client, and Xfce as the desktop environment for user interaction with the server.
We hope that using VNC technology helps streamline your server administration, making the process easier and more efficient.
We're prepared more detailed instruction on how to create server on Ubuntu if you have some trouble deploying it.
30 May 2025 · 8 min to read
Do you have questions,
comments, or concerns?
Our professionals are available to assist you at any moment,
whether you need help or are just unsure of where to start.
whether you need help or are just unsure of where to start.
