First Steps on a New Linux VPS (Setup Checklist)

A brand-new VPS is exposed to the internet from the moment it boots, and bots start probing SSH within minutes. These first steps on a new Linux VPS make it secure and ready for your apps. The commands target Ubuntu/Debian, with AlmaLinux/Rocky equivalents noted.

Before you start

The VPS IP address and root password or SSH key from your provider.
An SSH client (Terminal on macOS/Linux, Windows Terminal or PuTTY on Windows).
Panel access (VNC console) in case you lock yourself out; see VNC console access.

Log in and update

ssh root@203.0.113.10

apt update && apt upgrade -y

On AlmaLinux/Rocky: dnf upgrade -y. Reboot if the kernel was updated.

Set hostname and timezone

hostnamectl set-hostname vps1.example.com

timedatectl set-timezone Europe/Berlin

Create a sudo user

adduser deploy && usermod -aG sudo deploy

On RHEL-family systems use the wheel group.

Set up SSH keys

On your own computer:

ssh-keygen -t ed25519

ssh-copy-id deploy@203.0.113.10

Harden SSH

In /etc/ssh/sshd_config (or a file in sshd_config.d/) set:

PermitRootLogin no
PasswordAuthentication no

Then sudo systemctl restart ssh (sshd on RHEL). More options in the SSH lockdown checklist.

Enable a firewall

sudo ufw allow OpenSSH && sudo ufw allow 80,443/tcp && sudo ufw enable

On AlmaLinux/Rocky use firewalld: firewall-cmd --permanent --add-service={ssh,http,https} && firewall-cmd --reload.

Automatic security updates

sudo apt install -y unattended-upgrades && sudo dpkg-reconfigure -plow unattended-upgrades

RHEL family: dnf install dnf-automatic and enable its timer.

Add swap on small plans

A swap file prevents out-of-memory crashes on 1–2 GB VPSs. See create a swap file.

Plan backups and monitoring

Enable provider backups if offered, and keep an off-site copy; see back up to S3 with rclone.
Install fail2ban to block repeated login attempts.
Watch resource usage with htop and disk with df -h.

Troubleshooting

Locked out after SSH changes: use the VNC console to fix sshd_config.
Firewall blocked SSH: from the console run ufw allow OpenSSH or ufw disable.
Permission denied (publickey): check ~/.ssh/authorized_keys ownership and permissions (700 for the folder, 600 for the file).

Frequently asked questions

Should I change the SSH port?

It reduces log noise but is not real security. Keys and disabling passwords matter far more.

Which OS should I pick?

See Ubuntu vs Debian for a VPS.

Do I need a control panel?

Not necessarily. For hosting many websites without server admin, cPanel hosting may be easier.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket