First steps on a new VPS

Updated 2026-10-30

The first steps on a new VPS are: log in, update the system, create a sudo user with an SSH key, set the hostname and time zone, add swap on small plans, and turn on a firewall. That takes about 15 minutes and covers most of what attackers try first.

The commands below are for Ubuntu 24.04 and Debian 12. Replace values in angle brackets and the example address 203.0.113.10 with your own.

1. Log in for the first time

When you create a server you choose either an SSH key or a root password sent by email. With a key:

ssh [email protected]        # example address

The first connection asks you to confirm the host key fingerprint. Type yes. If you used a password, you will be asked for it; change it straight away with passwd.

If you don't have a key yet, read how to create and use SSH keys first. It takes two minutes and is worth it.

2. Update everything

New images are recent, but packages move fast. Update before you install anything:

apt update
apt full-upgrade -y
apt autoremove -y

If the kernel was updated, reboot:

[ -f /var/run/reboot-required ] && reboot

Wait half a minute and log in again.

3. Turn on automatic security updates

Ubuntu ships unattended-upgrades; on Debian you may need to install it:

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades   # answer "Yes"

This installs security fixes daily. It does not reboot by default. To allow reboots at a quiet hour, edit /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";

4. Create a normal user with sudo

adduser deploy                 # pick any name
usermod -aG sudo deploy

Copy root's authorised keys to the new user so you can log in with the same key:

mkdir -p /home/deploy/.ssh
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Open a second terminal and test before you continue:

ssh [email protected]
sudo whoami      # should print: root

Keep the root session open until the new login works.

5. Set hostname and time zone

sudo hostnamectl set-hostname web-1
sudo timedatectl set-timezone Europe/Berlin
timedatectl          # check: "System clock synchronized: yes"

Add the hostname to /etc/hosts if sudo warns that it cannot resolve it:

127.0.1.1   web-1

Many admins keep servers on UTC to make logs easier to compare. Either is fine; just be consistent.

6. Add swap on small servers

Plans with 1 or 2 GB of memory benefit from a swap file. Check first:

swapon --show
free -h

If nothing is listed, create a 1 GB or 2 GB file:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Tell the kernel to prefer memory and swap only under pressure:

echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swap.conf
sudo sysctl --system

7. Turn on a firewall

You have two layers, and you can use both.

On the server: UFW

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Open other ports only when a service needs them, for example sudo ufw allow 80,443/tcp for a web server.

In front of the server: cloud firewall

A Wolkra firewall filters traffic before it reaches the server and can be applied to many servers at once by label. It is free. A common setup allows SSH only from your office or home address and HTTP/HTTPS from anywhere. See the firewalls docs.

8. Harden SSH

Once key login works for your sudo user, disable passwords and root login. Create a drop-in file:

sudo tee /etc/ssh/sshd_config.d/10-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && sudo systemctl reload ssh

sshd -t checks the syntax first, so a typo does not lock you out. The full set of hardening steps is in how to secure an Ubuntu server.

9. Install a few useful tools

sudo apt install -y curl wget git htop ncdu unzip ca-certificates

• htop shows processes and memory live.
• ncdu / finds what is filling the disk.
• journalctl -p warning -b shows warnings since the last boot.

10. Set reverse DNS if you send email or need a clean name

If the server sends mail or should resolve back to a hostname, set the PTR record for its IP in the console. Make sure the forward DNS record (A or AAAA) points to the same address. See IP addresses.

11. Plan backups now

A fresh server is the best moment to decide on backups. On Wolkra you can enable daily automatic backups (20% of the server price, 7 restore points) and take snapshots before risky changes. For data that matters, add a copy outside the server too. The backup strategy guide explains the 3-2-1 rule in practice.

12. Know your way back in

Things go wrong: a firewall rule too strict, an SSH config typo. Before that happens, note where the rescue tools are:

• the browser (VNC) console in the server view, which works without network access;
• rescue mode, which boots a small system so you can mount the disk and fix files;
• rebuild, which reinstalls the image if the server is beyond repair.

Checklist

• Logged in with an SSH key
• Updated and rebooted
• Automatic security updates on
• Sudo user created and tested
• Hostname and time zone set
• Swap on small plans
• UFW and/or cloud firewall enabled
• Root login and passwords disabled
• Reverse DNS set if needed
• Backups enabled

Next, deploy something: try Docker Compose, WordPress or a Caddy reverse proxy.