First steps on a new Linux VPS

A new server is exposed to the internet from its first minute, and automated scanners will start trying passwords within hours. These steps are for Ubuntu or Debian; other distributions use different package commands but the same ideas.

1. Connect

ssh root@203.0.113.10

2. Update the system

apt update && apt upgrade -y

3. Create your own user

Work as a normal user with sudo instead of root.

adduser deploy
usermod -aG sudo deploy

4. Log in with a key, not a password

On your own computer, create a key if you do not have one, then copy it to the server:

ssh-keygen -t ed25519
ssh-copy-id deploy@203.0.113.10

Open a new terminal and confirm you can log in as the new user before going further.

5. Turn off password and root logins

In /etc/ssh/sshd_config set:

PermitRootLogin no
PasswordAuthentication no

Then reload SSH with sudo systemctl reload ssh. Keep your current session open until you have tested a new login.

6. Enable a firewall

sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

Only open the ports your services need.

7. Automatic security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

8. Before you install anything else

• Set the hostname and the timezone.
• Add swap if the server has little RAM.
• Decide where backups will go, and set them up now rather than later.