First Steps on a New Linux Server

A fresh VPS is a clean slate, and clean slates get scanned by bots within minutes of coming online. This checklist takes about ten minutes and turns a default install into a server you would be comfortable leaving on the internet. Commands are shown for Ubuntu and Debian first, with the AlmaLinux and Rocky equivalents where they differ.

1. Apply updates#

# Ubuntu / Debian
apt update && apt full-upgrade -y

# AlmaLinux / Rocky
dnf upgrade -y

If a kernel was updated, reboot with reboot and reconnect.

2. Create your own user with sudo#

Working as root all day is how a typo becomes an outage. Make a personal account and give it sudo:

# Ubuntu / Debian
adduser alex
usermod -aG sudo alex

# AlmaLinux / Rocky
adduser alex && passwd alex
usermod -aG wheel alex

Open a second terminal and confirm you can log in as that user and run sudo -v before you go further.

3. Switch SSH to keys#

Follow Set Up SSH Key Authentication for your new user, then disable password logins and direct root login. That one change removes brute-force attacks from your list of concerns.

4. Turn on a firewall#

Allow SSH first, then enable. Full detail, including firewalld and Windows, in Manage the Firewall on Your VPS.

# Ubuntu / Debian (UFW)
ufw allow OpenSSH
ufw enable
ufw status verbose

5. Set the hostname and timezone#

hostnamectl set-hostname web1.example.com
timedatectl set-timezone America/Los_Angeles
timedatectl

Correct time matters more than it looks: TLS, log correlation, and two-factor codes all depend on it. Stock distribution images ship with time sync (systemd-timesyncd or chrony) enabled; timedatectl shows System clock synchronized: yes when it is working, and if it does not, install chrony and enable it.

6. Enable automatic security updates#

# Ubuntu / Debian
apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# AlmaLinux / Rocky
dnf install -y dnf-automatic
systemctl enable --now dnf-automatic.timer

7. Slow down brute-force attempts#

With keys only, password guessing cannot succeed, but it still fills your logs. fail2ban bans repeat offenders at the firewall:

apt install -y fail2ban      # or: dnf install -y epel-release && dnf install -y fail2ban
systemctl enable --now fail2ban

8. Decide how you will back up#

Every VPS plan includes one free off-node backup, and RAID protects you from a single failed drive, but neither is a substitute for a copy you control. Read Backups, RAID, and Data Protection before there is data worth losing.

9. Set reverse DNS if you will send mail#

If this server will send email, or you just want clean-looking logs, request a reverse DNS record that matches the hostname you set in step 5. Outbound mail also has policy implications; skim Acceptable Use, Spam, and Abuse Reports first.

10. Now install the thing you came for#

With the basics done, deploy your application. For popular self-hosted stacks we keep dedicated guides with sizing advice under Solutions: n8n, Nextcloud, WordPress, cPanel and DirectAdmin, OpenClaw, and Hermes Agent.