Ubuntu Server

Ubuntu LTS is the default assumption in most server documentation, which makes it the pragmatic choice even where a technical argument favours something else. Five years of security maintenance and a package for nearly everything is a reasonable trade.

Reach for the LTS release for anything that will still be running next year. Reach for an interim release only when you need a kernel or a package version the LTS does not have, and accept a nine-month support window if you do.

The 24.04 release changed two things that quietly break older instructions. SSH is socket-activated, so the listening port is owned by ssh.socket and editing Port in sshd_config no longer does what tutorials say. And the logging story has moved toward journald, so guides that assume /var/log/auth.log exists — fail2ban’s default jail among them — need adjusting.

Beyond that, most Ubuntu-specific trouble is resource limits. File descriptor ceilings inherited from a systemd unit rather than your login shell. inotify watcher limits that dev servers and log shippers exhaust. Values set with sysctl -w that vanish on reboot because they were never written to /etc/sysctl.d/.

Unattended upgrades are worth enabling on every host and worth configuring deliberately: security pocket on, automatic reboot off unless a reboot at 06:00 is genuinely acceptable, and /var/run/reboot-required watched from wherever you watch things.

Articles here state which release they were verified on, because the answer has changed more between 22.04 and 24.04 than the version numbers suggest.