VPS First Setup Guide: Secure Server Checklist

You just purchased a VPS and are connecting for the first time. What should you do now? The default configuration is not security-optimized: SSH is open with root password, no firewall, and the system is not up to date. This guide provides a step-by-step checklist to set up a secure server from scratch.

Follow all steps in order. Do not close your existing SSH connection while changing SSH configuration — test each change from a new terminal tab.

Step 1: First SSH Connection

Get your server's IP address and root password from the REXE panel. Then connect from your terminal:

hljs bash

ssh root@SERVER_IP

After connecting, check your system information:

hljs bash

# OS information
cat /etc/os-release

# System resources
free -h
df -h
nproc

# Uptime
uptime

Step 2: Update the System

The first thing to do is update the system. Outdated packages may contain security vulnerabilities.

hljs bash

# For Ubuntu/Debian
apt update && apt upgrade -y

# Clean up unnecessary packages
apt autoremove -y
apt autoclean

# For AlmaLinux/Rocky Linux
dnf update -y
dnf autoremove -y

If a kernel update arrives during the upgrade, you may need to restart the server: reboot

Step 3: Create a Non-Root User

Working directly as root is dangerous. Create a regular user with sudo privileges:

hljs bash

# Create new user
adduser admin

# Add to sudo group (Ubuntu/Debian)
usermod -aG sudo admin

# Add to wheel group (AlmaLinux/Rocky)
usermod -aG wheel admin

# Switch to user and test
su - admin
sudo whoami  # Should output "root"
exit

SSH Key Setup

Using SSH keys instead of passwords is much more secure:

hljs bash

# On your local machine, generate a key pair
ssh-keygen -t ed25519 -C "vps-admin"

# Copy the public key to the server
ssh-copy-id admin@SERVER_IP

# Or manually:
cat ~/.ssh/id_ed25519.pub
# Paste the output on the server:
mkdir -p /home/admin/.ssh
nano /home/admin/.ssh/authorized_keys
chmod 700 /home/admin/.ssh
chmod 600 /home/admin/.ssh/authorized_keys
chown -R admin:admin /home/admin/.ssh

Step 4: Harden SSH Configuration

Edit the SSH configuration file:

hljs bash

nano /etc/ssh/sshd_config

Apply the following settings:

# Disable root login
PermitRootLogin no

# Disable password authentication (after SSH key is set up)
PasswordAuthentication no

# Disallow empty passwords
PermitEmptyPasswords no

# Maximum login attempts
MaxAuthTries 3

# Login timeout
LoginGraceTime 30

# Change SSH port (optional but recommended)
Port 2222

# Allow only specific users
AllowUsers admin

hljs bash

# Test configuration
sshd -t

# Restart SSH service
systemctl restart sshd

# Test connection from a NEW TERMINAL!
ssh -p 2222 admin@SERVER_IP

If you changed the SSH port, verify you can connect on the new port before updating firewall rules!

Step 5: Set Up a Firewall

With UFW (Ubuntu/Debian)

hljs bash

# Install UFW
apt install ufw -y

# Default policies
ufw default deny incoming
ufw default allow outgoing

# Allow SSH port (use 2222 if you changed it)
ufw allow 2222/tcp
# or for default port:
# ufw allow ssh

# Web services (if needed)
ufw allow 80/tcp
ufw allow 443/tcp

# Enable UFW
ufw enable

# Check status
ufw status verbose

With firewalld (AlmaLinux/Rocky)

hljs bash

# Start firewalld
systemctl start firewalld
systemctl enable firewalld

# Allow SSH port
firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --remove-service=ssh
firewall-cmd --reload

# Check status
firewall-cmd --list-all

Step 6: Install Fail2Ban

Fail2Ban provides automatic protection against brute-force attacks:

hljs bash

# Install Fail2Ban
apt install fail2ban -y  # Ubuntu/Debian
# or
dnf install fail2ban -y  # AlmaLinux/Rocky

# Create local configuration
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local

hljs ini

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
port = 2222
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400

hljs bash

# Start Fail2Ban
systemctl start fail2ban
systemctl enable fail2ban

# Check status
fail2ban-client status
fail2ban-client status sshd

Step 7: Configure Timezone

The correct timezone is important for meaningful log files:

hljs bash

# Check current timezone
timedatectl

# Set your timezone (example: UTC)
timedatectl set-timezone UTC

# Enable NTP synchronization
timedatectl set-ntp true

# Verify
timedatectl status
date

Step 8: Install Essential Tools

hljs bash

# Useful tools
apt install -y \
  curl wget git vim htop \
  net-tools dnsutils \
  unzip tar \
  logwatch

Post-Setup Verification Checklist

Verify your setup is complete with these checks:

hljs bash

# Is SSH service running?
systemctl status sshd

# Is firewall active?
ufw status  # or: firewall-cmd --state

# Is Fail2Ban running?
fail2ban-client status

# Is system up to date?
apt list --upgradable 2>/dev/null | head -20

# Open ports
ss -tlnp

# Recent login attempts
grep "Failed password" /var/log/auth.log | tail -10

✅ Quick Checklist

Conclusion

After completing these steps, your server meets basic security standards. As a next step, we recommend reviewing our Server Security Hardening guide. Remember to perform regular system updates and monitor your logs.

VPS First Setup Guide: Secure Server Checklist

Table of Contents