Installing Ubuntu Server

Ubuntu Server is the system this site recommends for every build, for a reason that has nothing to do with technology: it is the one with the most answers written about it elsewhere. On a machine you administer alone on a Sunday evening, the value of a system is measured by how many people have already had exactly your problem.

26.04 LTS was released on 23 April 2026. LTS means five years of security updates — through April 2031 — without reinstalling anything in between.

Set aside thirty minutes, twenty of which are waiting.

What you need

• The machine, a screen and a keyboard. Once installed, it will run without either.
• A USB stick of at least 4 GB, whose contents will be erased.
• An Ethernet cable. Wi-Fi works, but a server at the end of a cable is a server you can find again.

Step 1 — Download the image, and check it arrived intact

The server image is at releases.ubuntu.com/26.04: the file is ubuntu-26.04-live-server-amd64.iso, just under 3 GB. Take the server image, not the desktop one: the latter installs a graphical desktop that will spend memory drawing a wallpaper nobody will ever look at.

A 3 GB download sometimes ends badly, and one missing byte gives you an install that fails twenty minutes later without saying why. Checking takes ten seconds:

sha256sum ubuntu-26.04-live-server-amd64.iso

It must print exactly:

dec49008a71f6098d0bcfc822021f4d042d5f2db279e4d75bdd981304f1ca5d9

On Windows, certutil -hashfile ubuntu-26.04-live-server-amd64.iso SHA256 does the same job.

That checksum was read on 28 July 2026 from SHA256SUMS. If yours differs, compare against that file rather than this page: LTS images are republished with each point release (26.04.1, 26.04.2…), and the checksum moves with them.

Step 2 — Write the USB stick

The image has to be written block by block, not copied: dragging the ISO onto the stick gives you a stick containing a file, not a stick that boots.

Windows, macOS, Linux — balenaEtcher does exactly one thing and does it well: pick the image, pick the stick, write. On Windows, Rufus is the other habit, in "DD image" mode if it asks.

Linux, from the command line — lsblk first, so you identify the stick without guessing:

lsblk -o NAME,SIZE,MODEL
sudo dd if=ubuntu-26.04-live-server-amd64.iso of=/dev/sdX bs=4M status=progress oflag=sync

Replace /dev/sdX with the stick — sdb, sdc — and never with a partition (sdb1). A mistake here wipes a disk without asking: read the size lsblk printed and confirm it matches the stick, not your system drive.

Step 3 — Boot from it

Plug the stick in, power on, and press the key that opens the boot menu. It depends on the manufacturer: F12 on Dell and Lenovo, F9 on HP, F11 or Esc on many motherboards, F2 or Del to enter the BIOS/UEFI. The screen shows it for a second at power-on.

Two settings worth checking in the BIOS if the stick does not appear:

• Secure Boot: Ubuntu handles it, so leave it on. If it still refuses, turn it off.
• Restore after power loss: look for Restore on AC Power Loss or After Power Failure, and set it to Power On. Without it, your server stays off after the next outage — and you will find out while wondering why nothing answers any more.

Step 4 — The installer, screen by screen

Language and keyboard. The keyboard matters: a password typed on one layout and read back on another does not come back. The installer offers to detect it by having you press a few keys — take it.

Installer update. If offered, accept: it is the installer updating itself, not the system.

Network. The installer configures wired interfaces over DHCP on its own. Write down the IP address it shows, you will need it in ten minutes. We will pin it properly later.

Proxy and mirror. Leave both empty unless you know why you would not.

Storage. For a first server, keep "use an entire disk" and choose the right one. Two notes:

• Untick LVM if you have no use for it. It is not a bad choice, it is one more layer to understand on the day something goes wrong.
• If the machine has several disks, install the system on the smallest and keep the large ones for data. You cannot replace a system disk without reinstalling; a data disk unplugs and plugs back in.

The next screen summarises what is about to be written. It is the last moment where nothing is lost.

Account. A lowercase username, no accents. The hostname will end up in your shell prompt and in your URLs: pick one that describes the MACHINE rather than what it happens to run today — server or nas age better than immich.

Ubuntu Pro. You can skip it. It is free for personal use on up to five machines and extends support for some packages, but it needs an account and can be attached later.

SSH. Tick Install OpenSSH server. Without it you will have to keep a screen plugged in.

If your public keys are on GitHub, this screen offers to import them: type your username and the installer fetches them. Take that option — a server that only accepts keys does not get its password guessed.

Snaps. Tick nothing. You will install what you need when you need it.

Then the install runs. Ten to twenty minutes depending on disk and connection. When it finishes, remove the USB stick before rebooting.

Step 5 — First connection

From another computer on the network:

ssh [email protected]

The address is the one from step 4. If you lost it, the server's login screen shows it, or your router lists it under connected devices.

Update once:

sudo apt update && sudo apt upgrade -y

Step 6 — Pin the IP address

A DHCP address changes. On the day it changes, everything you configured points at nothing — and nothing will warn you.

Two ways, and the first is better:

From the router (recommended) — look for static lease, DHCP reservation or address reservation in your router's interface, and tie the address you want to the server's MAC address. Everything stays in one place, and you cannot collide with another machine.

From the server — Netplan, editing the file in /etc/netplan/:

ls /etc/netplan/
sudo nano /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    enp3s0:
      dhcp4: false
      addresses:
        - 192.168.1.42/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [192.168.1.1, 9.9.9.9]

Replace enp3s0 with your actual interface (ip -br a prints it) and 192.168.1.1 with your router. Then:

sudo netplan try

netplan try applies the configuration and rolls it back on its own after 120 seconds unless you confirm. That is exactly what you want when changing the network of a machine you reach over the network: a typo locks you out, and this command lets you back in without you doing anything.

Step 7 — What you set once and forget

Automatic security updates. A server that is always on and never updated is a machine that eventually belongs to someone else.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Password SSH, disabled — only if you already imported your keys and verified they work. Open a second connection in another terminal before closing the first.

sudo nano /etc/ssh/sshd_config.d/99-hardening.conf

PasswordAuthentication no
PermitRootLogin no

sudo systemctl restart ssh

A file in sshd_config.d/ rather than an edit to sshd_config: a package update will not overwrite your settings, and a single rm undoes everything.

The firewall. Ubuntu ships ufw, disabled by default:

sudo ufw allow OpenSSH
sudo ufw enable

Allow SSH before enabling the firewall. In the other order you disconnect yourself from a machine that now refuses to answer you.

Next

The system is ready. Docker comes next: Installing Docker.

And to reach it from outside, two roads — setting up Cloudflare Tunnel, which opens no port, or opening a port on your router.

One last thing, which is not technical: write down the hostname, the pinned IP and the username. In six months, when you need to touch it again, you will not remember.