Skip to main content
Back to Category

VPS First Setup Guide: Secure Server Checklist

Step-by-step VPS initial setup: first SSH login, system update, creating a non-root user, SSH hardening, firewall and fail2ban installation for a secure server.

Read time: 14 min VPS Getting Started
vpsinitial setupsshsecurityfirewallfail2banlinuxchecklist
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

VPS First Setup Guide: Secure Server Checklist

You just purchased a VPS and are connecting for the first time. What should you do now? The default configuration is not security-optimized: SSH is open with root password, no firewall, and the system is not up to date. This guide provides a step-by-step checklist to set up a secure server from scratch.

Follow all steps in order. Do not close your existing SSH connection while changing SSH configuration — test each change from a new terminal tab.

Step 1: First SSH Connection

Get your server's IP address and root password from the REXE panel. Then connect from your terminal:

hljs bash
ssh root@SERVER_IP

After connecting, check your system information:

hljs bash
# OS information
cat /etc/os-release

# System resources
free -h
df -h
nproc

# Uptime
uptime

Step 2: Update the System

The first thing to do is update the system. Outdated packages may contain security vulnerabilities.

hljs bash
# For Ubuntu/Debian
apt update && apt upgrade -y

# Clean up unnecessary packages
apt autoremove -y
apt autoclean

# For AlmaLinux/Rocky Linux
dnf update -y
dnf autoremove -y

If a kernel update arrives during the upgrade, you may need to restart the server: reboot

Step 3: Create a Non-Root User

Working directly as root is dangerous. Create a regular user with sudo privileges:

hljs bash
# Create new user
adduser admin

# Add to sudo group (Ubuntu/Debian)
usermod -aG sudo admin

# Add to wheel group (AlmaLinux/Rocky)
usermod -aG wheel admin

# Switch to user and test
su - admin
sudo whoami  # Should output "root"
exit

SSH Key Setup

Using SSH keys instead of passwords is much more secure:

hljs bash
# On your local machine, generate a key pair
ssh-keygen -t ed25519 -C "vps-admin"

# Copy the public key to the server
ssh-copy-id admin@SERVER_IP

# Or manually:
cat ~/.ssh/id_ed25519.pub
# Paste the output on the server:
mkdir -p /home/admin/.ssh
nano /home/admin/.ssh/authorized_keys
chmod 700 /home/admin/.ssh
chmod 600 /home/admin/.ssh/authorized_keys
chown -R admin:admin /home/admin/.ssh

Step 4: Harden SSH Configuration

Edit the SSH configuration file:

hljs bash
nano /etc/ssh/sshd_config

Apply the following settings:

# Disable root login
PermitRootLogin no

# Disable password authentication (after SSH key is set up)
PasswordAuthentication no

# Disallow empty passwords
PermitEmptyPasswords no

# Maximum login attempts
MaxAuthTries 3

# Login timeout
LoginGraceTime 30

# Change SSH port (optional but recommended)
Port 2222

# Allow only specific users
AllowUsers admin
hljs bash
# Test configuration
sshd -t

# Restart SSH service
systemctl restart sshd

# Test connection from a NEW TERMINAL!
ssh -p 2222 admin@SERVER_IP

If you changed the SSH port, verify you can connect on the new port before updating firewall rules!

Step 5: Set Up a Firewall

With UFW (Ubuntu/Debian)

hljs bash
# Install UFW
apt install ufw -y

# Default policies
ufw default deny incoming
ufw default allow outgoing

# Allow SSH port (use 2222 if you changed it)
ufw allow 2222/tcp
# or for default port:
# ufw allow ssh

# Web services (if needed)
ufw allow 80/tcp
ufw allow 443/tcp

# Enable UFW
ufw enable

# Check status
ufw status verbose

With firewalld (AlmaLinux/Rocky)

hljs bash
# Start firewalld
systemctl start firewalld
systemctl enable firewalld

# Allow SSH port
firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --remove-service=ssh
firewall-cmd --reload

# Check status
firewall-cmd --list-all

Step 6: Install Fail2Ban

Fail2Ban provides automatic protection against brute-force attacks:

hljs bash
# Install Fail2Ban
apt install fail2ban -y  # Ubuntu/Debian
# or
dnf install fail2ban -y  # AlmaLinux/Rocky

# Create local configuration
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local
hljs ini
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
port = 2222
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400
hljs bash
# Start Fail2Ban
systemctl start fail2ban
systemctl enable fail2ban

# Check status
fail2ban-client status
fail2ban-client status sshd

Step 7: Configure Timezone

The correct timezone is important for meaningful log files:

hljs bash
# Check current timezone
timedatectl

# Set your timezone (example: UTC)
timedatectl set-timezone UTC

# Enable NTP synchronization
timedatectl set-ntp true

# Verify
timedatectl status
date

Step 8: Install Essential Tools

hljs bash
# Useful tools
apt install -y \
  curl wget git vim htop \
  net-tools dnsutils \
  unzip tar \
  logwatch

Post-Setup Verification Checklist

Verify your setup is complete with these checks:

hljs bash
# Is SSH service running?
systemctl status sshd

# Is firewall active?
ufw status  # or: firewall-cmd --state

# Is Fail2Ban running?
fail2ban-client status

# Is system up to date?
apt list --upgradable 2>/dev/null | head -20

# Open ports
ss -tlnp

# Recent login attempts
grep "Failed password" /var/log/auth.log | tail -10

✅ Quick Checklist

  • First SSH connection made
  • System updated (apt update && apt upgrade)
  • Non-root sudo user created
  • SSH key installed
  • SSH root login disabled (PermitRootLogin no)
  • SSH password login disabled (PasswordAuthentication no)
  • SSH port changed (optional)
  • Firewall installed and configured
  • Fail2Ban installed and enabled
  • Timezone configured
  • Essential tools installed
  • SSH connection tested with new user

Conclusion

After completing these steps, your server meets basic security standards. As a next step, we recommend reviewing our Server Security Hardening guide. Remember to perform regular system updates and monitor your logs.

Frequently Asked Questions

Where do I find the root password when first connecting to my VPS?

The root password is displayed on your server's detail page in the REXE customer panel. It is also sent by email when the server setup is complete. It is recommended to change the password after the first login.

Can I log in with a password without an SSH key?

Yes, but it is not recommended. Password login is vulnerable to brute-force attacks. After setting up an SSH key, disable password login by setting PasswordAuthentication no. Make sure to back up your key so you don't lose access.

Is changing the SSH port mandatory?

Not mandatory, but recommended. The default port 22 is targeted by automated scanning tools. Changing the port significantly reduces such attacks. Combined with Fail2Ban, it provides much more effective protection.

I can't access my server after setting up the firewall, what should I do?

You can connect to your server via VNC/KVM console from the REXE panel. Fix the firewall rules through the console: run ufw allow YOUR_SSH_PORT/tcp. Always make sure you have allowed your SSH port before changing firewall rules.

I accidentally banned my own IP with Fail2Ban, what should I do?

Connect via VNC console from the REXE panel and run: fail2ban-client set sshd unbanip YOUR_IP_ADDRESS. To prevent this in the future, add your IP to the ignoreip list in /etc/fail2ban/jail.local: add the line ignoreip = 127.0.0.1/8 YOUR_IP.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps