A fresh VPS boots as a single root account reachable by password: fine for the first login, wrong for anything after. These are the first ten minutes on a new server: create a real user, lock down SSH, turn on a firewall and enable automatic security updates. The commands below assume Ubuntu or Debian; the RHEL equivalents are noted where they differ.
- 1Log in and update
first login ssh root@your-server-ip apt update && apt upgrade -y # dnf upgrade -y on RHEL - 2Create a non-root user with sudo
Working as root full-time turns every typo into a potential disaster.
new admin user adduser deploy usermod -aG sudo deploy # -aG wheel on RHEL - 3Set up key-based SSH for that user
From your local machine, copy your public key to the new account:
from your laptop ssh-copy-id deploy@your-server-ip ssh deploy@your-server-ip # confirm it works before going further - 4Disable root login and passwords over SSH
Only once key login works, harden the daemon:
/etc/ssh/sshd_config PermitRootLogin no PasswordAuthentication no # then sudo sshd -t && sudo systemctl restart ssh - 5Turn on a firewall
ufw sudo ufw allow OpenSSH sudo ufw enable sudo ufw status - 6Enable automatic security updates
unattended-upgrades sudo apt install -y unattended-upgrades sudo dpkg-reconfigure -plow unattended-upgrades
Two more worthwhile minutes
sudo hostnamectl set-hostname web-01
sudo timedatectl set-timezone Europe/Berlin
# small servers benefit from a little swap
sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile
sudo mkswap /swapfile && sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstabWhat comes next
- Harden SSH further (see securing SSH access).
- Shape the firewall to your services (see the UFW guide).
- Point a domain at the box (see connecting a domain).
- Decide whether you want to keep running it yourself (see managed vs unmanaged VPS).
Every VMHeaven KVM plan deploys a clean Ubuntu, Debian or Rocky image in about a minute with a browser VNC console in the panel, so on a Linux server you can run through this checklist and never fear a lockout.
Frequently asked
What is the single most important first step?
Create a non-root user with sudo and switch to key-based SSH for it, then disable root login and passwords. That removes the biggest risk on a fresh box.
How do I avoid locking myself out while hardening SSH?
Keep your current session open and test the new login in a second terminal before closing the first. On a VPS with console access, even a mistake is recoverable.
Do small servers need swap?
A small swap file (1–2 GB) is cheap insurance against out-of-memory kills on low-RAM instances. It is not a substitute for enough RAM, but it smooths spikes.