Ubuntu 16.04
https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04

Ubuntu 14.04
https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-14-04

Ubuntu 16.04 – Steps

1. login to your server using Git (Vagrant) replacing ‘SERVER_IP_ADDRESS' with your DigitalOcean IP address:

$ ssh root@SERVER_IP_ADDRESS

or from Putty by entering username/password

2. add new user (replace ‘johndoe' with whatever you want):

$ adduser johndoe

enter password and optionally fill in additional information although to skip this, just hit ‘ENTER'.

3. To add ‘superuser' (root) privileges to the new user account (replace ‘johndoe' with whatever you want):

$ usermod -aG sudo johndoe

Optional Steps

To add public key authentication (optional but recommended), enter the following command at the terminal of your local machine (your computer/ from Vagrant Git command line):

$ ssh-keygen

Hit enter to accept the file name and path. Optionally, you can enter a passphrase or just leave blank.

Copy the public key to your server:

$ ssh-copy-id johndoe@SERVER_IP_ADDRESS

Disabling password authentication

Now that your new user can use SSH keys to log in, you can increase your server's security by disabling password-only authentication. Doing so will restrict SSH access to your server to public key authentication only. That is, the only way to log in to your server (aside from the console) is to possess the private key that pairs with the public key that was installed.

Note: Only disable password authentication if you installed a public key to your user as recommended in the previous section, step four. Otherwise, you will lock yourself out of your server!

To disable password authentication on your server, follow these steps.

As root or your new sudo user, open the SSH daemon configuration:

$ sudo nano /etc/ssh/sshd_config

Find the line that specifies ‘PasswordAuthentication', uncomment it by deleting the preceding #, then change its value to “no”. It should look like this after you have made the change: sshd_config — Disable password authentication

PasswordAuthentication no

Here are two other settings that are important for key-only authentication and are set by default. If you haven't modified this file before, you do not need to change these settings: sshd_config — Important defaults

PubkeyAuthentication yes
ChallengeResponseAuthentication no

When you are finished making your changes, save and close the file using the method we went over earlier (CTRL-X, then Y, then ENTER).

Type this to reload the SSH daemon:

$ sudo systemctl reload sshd

Password authentication is now disabled. Your server is now only accessible with SSH key authentication.

Now, before you log out of the server, you should test your new configuration. Do not disconnect until you confirm that you can successfully log in via SSH.

In a new terminal on your local machine, log in to your server using the new account that you created. To do so, use this command (substitute your username and server IP address):

$ ssh johndoe@SERVER_IP_ADDRESS

If you added public key authentication to your user, your private key will be used as authentication. Otherwise, you will be prompted for your user's password.

Note about key authentication: If you created your key pair with a passphrase, you will be prompted to enter the passphrase for your key. Otherwise, if your key pair is passphrase-less, you should be logged in to your server without a password.

Once authentication is provided to the server, you will be logged in as your new user.

Remember, if you need to run a command with root privileges, type “sudo” before it like this:

$ sudo command_to_run

To optionally setup basic firewall see link:
https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04