Guides

First steps on a new Linux VPS

What to do in the first half hour on a new Ubuntu or Debian VPS: log in over SSH, update it, add your own user, switch to SSH keys and turn on a firewall.

1. Log in over SSH #

Your server's IP address, user name and password are on its page in the Portal, under Login details.

On Windows, macOS or Linux, open a terminal (on Windows, PowerShell or Windows Terminal) and type:

ssh [email protected]

Use your own server's address instead of 203.0.113.10, and its user name if it is not root. The first time, you are asked whether to trust the server: type yes. Then enter the password.

2. Update everything #

A new server is only as up to date as the image it was built from. Update it straight away:

apt update && apt upgrade -y

If the update installed a new kernel, restart the server with reboot, wait a minute and log in again.

3. Add your own user #

Working as root all the time makes one typo much more dangerous. Make a user for yourself and let it use sudo:

adduser alex
usermod -aG sudo alex

Use your own name instead of alex. From now on, log in as that user and put sudo in front of commands that need administrator rights.

4. Log in with an SSH key instead of a password #

A key cannot be guessed the way a password can. On your own computer (not the server), make a key if you do not have one already:

ssh-keygen -t ed25519

Press Enter to accept the place it is saved. A passphrase is a good idea: it protects the key if your computer is lost.

Then copy the public half to the server. On macOS or Linux:

ssh-copy-id [email protected]

On Windows, in PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys"

Now ssh [email protected] should log you in without asking for the server password.

5. Turn off password logins #

Once the key works, stop the server accepting passwords and root logins. Open the SSH settings:

sudo nano /etc/ssh/sshd_config

Find these lines (remove a # at the start if there is one) and set them to:

PermitRootLogin no
PasswordAuthentication no

Save with Ctrl+O, Enter, then Ctrl+X. Some images also set PasswordAuthentication in a file under /etc/ssh/sshd_config.d/. Check with grep -r PasswordAuthentication /etc/ssh/sshd_config.d/ and change it there too. Then restart SSH:

sudo systemctl restart ssh

Warning

Keep the window you are logged in with open. Open a second terminal and check that you can still log in with your key before you close the first. If you cannot, fix it from the first window.

6. Turn on the firewall #

Allow SSH first, then switch the firewall on, so it does not shut you out:

sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw enable

On Ubuntu with desktop, allow Remote Desktop too, or it stops connecting:

sudo ufw allow 3389/tcp

Open a port for each thing you run that needs one. For a website:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw status lists what is open.

If SSH shuts you out #

A firewall rule or an SSH setting can lock you out. Your server keeps running, and you can still reach it: open its page in the Portal and press Console. It opens the server's own screen in a new browser tab, with no SSH involved. Confirm with your account password (and your 2FA code, if you use one), press Enter if the screen is blank, then log in as root with your server's password and undo the change. Lost the password too? Use Change password on the same page first. Paste text types out something long for you, because the console cannot be pasted into directly.

7. Install security updates by themselves #

So that security fixes go in even when you forget:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Answer Yes.

8. Back up your data #

We look after the hardware, but the files and databases on your VPS are yours to back up. Copy anything you cannot afford to lose to somewhere off the server, on a schedule: another server, cloud storage, or your own computer.

What next #