How to Set Up a DigitalOcean Droplet on Ubuntu 24.04 ($200 Credit Guide)

We may earn commissions when you shop through the links below at no additional cost to you.

To set up and secure a DigitalOcean Droplet on Ubuntu 24.04, provision an instance via the cloud console, establish an SSH key connection, disable remote root login, configure an unprivileged sudo user, and enforce network boundary filtering using UFW and Fail2ban.

Why Choose DigitalOcean for Hosting & Security Labs?

Unlike traditional hyperscalers (AWS or GCP) that charge unpredictable fees for basic static IPs and bandwidth overages, DigitalOcean provides flat-rate compute instances (Droplets) with high-speed NVMe storage and predictable networking.

Step 1: Provisioning an Ubuntu 24.04 Droplet ($200 Credit)

Before provisioning your server, claim the developer promotional grant to spin up high-performance compute instances at zero upfront cost:

1. Sign up through the link above and navigate to Create > Droplets.

2. Distribution: Select Ubuntu 24.04 LTS (x64).

3. Droplet Type: Choose Basic with Regular or Premium NVMe SSD.

4. Data Center: Select the region closest to your target audience (e.g., Frankfurt for EU/MENA, New York for US).

5. Authentication: Choose SSH Key (recommended) to prevent password brute-forcing.

Step 2: Non-Root User & Key-Based Authentication

Operating directly under the root account exposes the host to accidental destructive commands and privilege abuse.

Connect to your Droplet via terminal and establish an isolated administrative user:

# Update repository packages
sudo apt update && sudo apt upgrade -y

# Create an isolated deployment user
sudo adduser deployer

# Grant administrative privileges
sudo usermod -aG sudo deployer

Transfer your local public key to the new user's authorized key directory:

# Switch to the isolated user environment
su - deployer
mkdir -p ~/.ssh
chmod 700 ~/.ssh

# Append your public key to authorized_keys
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... your_email@example.com" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
exit

Step 3: Hardening SSH Daemon Configuration

Automated bots continuously probe public IPv4 subnets for exposed port 22 credentials. Lock down the OpenSSH daemon configuration:

# Backup original SSH config
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Enforce secure configuration parameters
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

# Validate configuration syntax before restarting
sudo sshd -t && sudo systemctl restart ssh

Step 4: Network Boundary Defense with UFW

Enforce default-deny inbound policies using Uncomplicated Firewall (UFW) to drop unauthorized port sweeps at the kernel level:

# Set baseline traffic rules
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow operational protocols
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable active filtering
sudo ufw enable

Verify active listening boundaries:

sudo ufw status verbose

Step 5: Automated Intrusion Prevention with Fail2ban

Install Fail2ban to automatically block IP addresses exhibiting malicious behavioral patterns, such as repetitive SSH authentication failures:

# Install Fail2ban package
sudo apt install fail2ban -y

# Create local override configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Enable and start the protection service
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

# Verification Output
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
OpenSSH (v6)               ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     3
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     1
   `- Banned IP list:

Performance & Network Verification

Testing network stability via 100-packet ICMP probes to tier-1 transit backbones confirms low-latency connectivity without packet loss or hypervisor jitter:

❓ Frequently Asked Questions (FAQ)

How do I apply the $200 free credit to my account?

Sign up via the official partner link and link a valid payment method (credit card or PayPal) to verify your identity. The $200 promotional balance applies immediately for 60 days.

Can I run Docker containers on entry-level Droplets?

Yes. Basic 1 vCPU / 2GB RAM Droplets efficiently run multiple isolated Docker containers using Docker Compose behind reverse proxies like Traefik or Nginx.

Are static IPv4 addresses included with basic Droplets?

Yes. Every standard Droplet comes with a dedicated public IPv4 address and high outbound bandwidth allowances included in the flat monthly rate.

🚀 Next Steps & Maintenance

With SSH key authentication enforced, UFW active, and Fail2ban monitoring intrusion vectors, your droplet is ready for production workloads. To complete your setup, proceed with installing your web server (Nginx/Apache), provisioning free SSL certificates via Certbot, and enabling automated daily backups.

💡 Ready to build? Spin up your hardened Ubuntu instance today with DigitalOcean's $200 Developer Credit Grant (Valid for 60 days on new accounts).