Within minutes of going online, a new server starts receiving automated login attempts. These steps — about ten minutes of work — close the common holes and prepare the server for whatever you’ll run on it. Commands are for Ubuntu and Debian; notes cover AlmaLinux and Rocky where they differ.

1. Log in and update everything

ssh [email protected]
apt update && apt full-upgrade -y

(AlmaLinux/Rocky: dnf upgrade -y.) Reboot if the kernel was updated:

[ -f /var/run/reboot-required ] && reboot

2. Set the hostname and time zone

hostnamectl set-hostname web1
timedatectl set-timezone UTC      # or e.g. Asia/Hong_Kong, America/New_York
timedatectl

UTC keeps logs consistent across servers; a local zone is fine if that’s what your cron jobs expect. Confirm System clock synchronized: yes — accurate time matters for TLS, logs and 2FA codes.

3. Create a regular user with sudo

adduser alice
usermod -aG sudo alice        # AlmaLinux/Rocky: usermod -aG wheel alice

4. Set up SSH keys

On your computer (if you don’t have a key yet):

ssh-keygen -t ed25519
ssh-copy-id [email protected]

Test in a new terminal: ssh [email protected], then sudo whoami. Details in creating SSH keys.

5. Lock down SSH

Only after key login works:

sudo tee /etc/ssh/sshd_config.d/10-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && sudo systemctl reload ssh     # "sshd" on AlmaLinux/Rocky

Verify the effective settings with sudo sshd -T | grep -E 'permitroot|passwordauth', and test a fresh login before closing your current session. See disable root SSH login.

6. Enable a firewall

Ubuntu / Debian (UFW):

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

AlmaLinux / Rocky (firewalld): it’s on by default with SSH allowed; check with sudo firewall-cmd --list-all.

Open more ports only when you install services that need them (sudo ufw allow 'Nginx Full'). See the UFW guide.

7. Install Fail2Ban

sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.local > /dev/null <<'EOF'
[DEFAULT]
bantime = 1h
backend = systemd
[sshd]
enabled = true
EOF
sudo systemctl enable --now fail2ban

Details in the Fail2Ban guide.

8. Automatic security updates

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

(AlmaLinux/Rocky: dnf install dnf-automatic and enable dnf-automatic.timer with apply_updates = yes.) See automatic security updates.

9. Add swap (small servers)

A swap file prevents out-of-memory crashes during spikes:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swap.conf && sudo sysctl --system

Skip it if free -h already shows swap. See swap file vs partition.

10. Install a few essentials

sudo apt install -y curl wget git htop tmux unzip ca-certificates

tmux keeps long-running commands alive if your SSH connection drops.

Bonus steps worth doing soon

  • Backups: decide now where backups go — see automated backups with BorgBackup.
  • Monitoring: an external uptime check (Uptime Kuma) and resource monitoring.
  • Reverse DNS: if the server sends email, set the PTR record (on our USA VPS you can do it in the client area) — see PTR records.
  • Change the SSH port to cut log noise: how to.

Quick verification

sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'
sudo ufw status
sudo fail2ban-client status sshd
free -h
timedatectl | grep synchronized

What next?

Install your stack:

For a more detailed walkthrough on Ubuntu, see Ubuntu 24.04 initial server setup, and for a longer security list, the Linux server hardening checklist. If you ever lock yourself out, every VPS.DO server has a VNC console in the client area.

  • VPS
  • Security
  • Linux