How to Set Up an Ubuntu 24.04 VPS on Contabo: Step-by-Step Production Guide

Introduction: Why Contabo VPS for Linux Workloads?

Contabo is widely recognized as the market price-performance leader in cloud virtualization. For roughly $5.50 per month, their entry-level Cloud VPS 1 delivers 4 vCPU cores, 8 GB of ECC RAM, and 50 GB of high-speed NVMe storage. However, unlike managed hosts like Hostinger or shared cPanel providers, Contabo gives you a bare-metal hypervisor instance. You are the sole systems administrator responsible for OS updates, network security, user privileges, and firewall rules.

In this comprehensive guide, we take a freshly provisioned Ubuntu 24.04 LTS instance from initial email credentials to a fully hardened, enterprise-ready production server.

Phase 1: Ordering & Initial CCP Configuration

When ordering your VPS from Contabo, select the following recommended options:

• Region: Choose the data center closest to your target audience (Germany for European traffic, Central US/St. Louis or New York for the Americas, Singapore for APAC).
• Storage Type: Always select 100% NVMe storage rather than standard SSD for 5x to 10x faster disk I/O.
• Operating System: Select Ubuntu 24.04 LTS (Noble Numbat) for 5 years of canonical security patches.
• SSH Keys: Contabo allows pasting your public SSH key directly into the checkout form. If you do this, password authentication is automatically disabled on boot.

Phase 2: First SSH Connection via Root

Once you receive the setup confirmation email containing your server IP address, open your local terminal (macOS/Linux) or PowerShell (Windows 11) and establish your first session:

ssh root@YOUR_CONTABO_SERVER_IP

Accept the ECDSA host key fingerprint by typing yes. Enter the root password provided in the Contabo welcome email.

Phase 3: Upgrading Core System Repositories

Fresh cloud images often sit on repositories that are several months old. Immediately refresh APT indices and patch the kernel and standard utilities:

# Refresh repository metadata
sudo apt update

# Perform full distribution upgrade
sudo apt upgrade -y

# Remove obsolete dependencies
sudo apt autoremove -y

# Verify running kernel version
uname -r

Phase 4: Creating a Dedicated Sudo User

Operating a production server as root is a major security vulnerability. A single typo in rm -rf or an exploited service can destroy your entire file system. Create a dedicated administrative user with superuser privileges:

# Add a new user (replace 'deployer' with your chosen username)
adduser deployer

# Grant sudo administrative access
usermod -aG sudo deployer

# Verify group membership
groups deployer

Phase 5: Configuring Ed25519 SSH Key Authentication

Passwords are vulnerable to brute-force dictionary attacks. We will configure an ultra-secure Ed25519 elliptic curve keypair.

On your local machine, generate an SSH key if you do not already have one:

ssh-keygen -t ed25519 -C "contabo-production-key"

Next, copy your public key to your new remote server user:

ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@YOUR_CONTABO_SERVER_IP

Phase 6: Hardening SSH Daemon Configuration

Now lock down SSH access so that attackers cannot even attempt password logins or target the root user directly. Open the SSH daemon configuration:

sudo nano /etc/ssh/sshd_config.d/99-hardened.conf

Add the following hardened security directives:

# Change standard SSH port to defeat automated bot scanners
Port 2222

# Strictly disable root login
PermitRootLogin no

# Disable password authentication completely
PasswordAuthentication no
PermitEmptyPasswords no

# Maximum authentication attempts before disconnect
MaxAuthTries 3

# Allow only public key authentication
PubkeyAuthentication yes

Before restarting SSH, test the syntax to prevent locking yourself out:

sudo sshd -t

If no errors return, reload the SSH daemon:

sudo systemctl restart ssh

Phase 7: Setting Up UFW (Uncomplicated Firewall)

Ubuntu includes UFW by default. Configure strict default deny rules before enabling the firewall:

# Reset UFW to default settings
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow custom SSH port
sudo ufw allow 2222/tcp comment "Hardened SSH Port"

# Allow HTTP and HTTPS web traffic
sudo ufw allow 80/tcp comment "HTTP Web"
sudo ufw allow 443/tcp comment "HTTPS Secure Web"

# Enable UFW
sudo ufw enable

# Verify active status
sudo ufw status verbose

Phase 8: Timezone & Automatic Security Updates

Consistent timestamps are critical for parsing access logs, database transactions, and cron jobs:

# Set server timezone to UTC
sudo timedatectl set-timezone UTC

# Enable unattended security upgrades
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Phase 9: Troubleshooting Common Initial Setup Errors

1. SSH Connection Refused on Port 2222

If you cannot connect after changing the SSH port, verify whether UFW is blocking port 2222. Log into the Contabo Customer Control Panel, open the browser-based VNC Console, and run sudo ufw allow 2222/tcp && sudo systemctl restart ssh.

2. sudo: unable to resolve host

This harmless warning occurs if your hostname is not mapped in /etc/hosts. Edit /etc/hosts and add: 127.0.1.1 your-server-hostname.

Phase 10: Frequently Asked Questions (FAQ)

Should I choose Ubuntu 22.04 or 24.04 on Contabo?

Ubuntu 24.04 LTS is the modern standard offering Linux Kernel 6.8+, native OpenSSL 3.0 support, and security updates through 2029. Choose 22.04 only if you must run legacy software incompatible with PHP 8.3 or Python 3.12.

How do I test my server's disk speed on Contabo?

Install the fio benchmarking utility and run a random read/write test: sudo apt install -y fio && fio --name=test --bs=4k --size=1G --rw=randwrite --direct=1. You should observe write speeds above 1,200 MB/s.

Next Steps & Recommendation

Your Contabo Ubuntu 24.04 VPS is now fully hardened against 99.9% of automated Internet attacks. You are now ready to install Docker, aaPanel, or your web server of choice.