The first 10 minutes with a new Linux VPS: SSH key, updates and firewall

Post by **rychy** » Mon Nov 02, 2026 9:42 am

The first 10 minutes with a new Linux VPS

A new server is clean, but it is not "ready". Bots on the internet try passwords all the time and they will not wait for you to finish setting things up. This is what we do in the first 10 minutes after the login details arrive. The commands are for Debian/Ubuntu, and where they differ, also for AlmaLinux/Rocky.

Log in and change the password

Your login details arrive by email: user, password and SSH port.

Code: Select all

ssh -p PORT [email protected]

First thing: a new, long password that you do not use anywhere else:

Code: Select all

passwd

Update the system

Code: Select all

# Debian / Ubuntu
sudo apt update && sudo apt upgrade -y

# AlmaLinux / Rocky
sudo dnf upgrade -y

If the kernel was updated, reboot: sudo reboot

Log in with an SSH key instead of a password

A key cannot be "guessed" like a password. You create it on your own computer (Windows 10/11, macOS and Linux all have ssh-keygen):

Code: Select all

ssh-keygen -t ed25519

Upload the public key to the server:

Code: Select all

# Linux / macOS
ssh-copy-id -p PORT [email protected]

# Windows (PowerShell)
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh -p PORT [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Log out and back in. If it does not ask for the password (or only asks for the key's passphrase), the key works.

(Optional) Turn off password login

Only once the key works! Keep one SSH window open while you test in another, so you can undo it if something goes wrong.

Code: Select all

echo "PasswordAuthentication no" | sudo tee /etc/ssh/sshd_config.d/00-keys-only.conf
sudo sshd -t && sudo systemctl restart ssh    # AlmaLinux/Rocky: sshd
sudo sshd -T | grep passwordauthentication   # should say: no

The 00- prefix is on purpose: in SSH the first setting wins, and some systems already have a file that allows passwords.
Keep a copy of your key somewhere safe. Without it, and without a password, you cannot log in.

Firewall

Inside the server SSH runs on port 22 (the port in the email is only the outside one). Allow SSH before you turn the firewall on:

Code: Select all

# Debian / Ubuntu
sudo apt install -y ufw
sudo ufw allow 22/tcp
sudo ufw enable

# AlmaLinux / Rocky
sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Running a website? Also allow 80/tcp (Ubuntu: sudo ufw allow 80/tcp, Alma: --add-service=http).

Docker opens container ports on its own and bypasses ufw. Keep that in mind.

Automatic security updates

Most break-ins use holes that were fixed long ago. Let the server update itself:

Code: Select all

# Debian / Ubuntu
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# AlmaLinux / Rocky
sudo dnf install -y dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/; s/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

Check who logs in

Code: Select all

last -n 10                        # recent logins
sudo journalctl -u ssh --since today   # AlmaLinux/Rocky: -u sshd

Login attempts with wrong user names (admin, test, oracle…) are normal internet noise. What matters is that there is no successful login that is not yours.

What about fail2ban?

On an ordinary server with a public IP, fail2ban is a good idea. On our VPS, however, SSH goes through a shared entry point (ssh.vpsstorages.com), so the server sees every login as coming from the same address. fail2ban would block that address and lock you out too. Here the better protection is a key plus a strong password.

Or with one tick when you order

When you order a Linux VPS you can pick the free "Server hardening" add-on. It does steps 5 and 6 for you (firewall and automatic updates), limits SSH login attempts and tightens the system's network settings. Password login stays on, so you add the SSH key (steps 3–4) yourself if you want one.

Questions? Post them here in the topic