Skip to main content
After setting up a new Linux VPS, log in as root and, in this order: update all packages, create a normal user with sudo, add your SSH key, disable SSH password login, turn on a firewall that allows SSH, enable automatic security updates, set the timezone and hostname, add Fail2ban, set up backups, and check what is listening. The whole list takes about 30 to 45 minutes on Ubuntu 24.04, Debian 13 or AlmaLinux / Rocky Linux 9 or 10.

​
Before you start

  • SSH into your server as root.
  • Keep the VNC console in mind: if an SSH or firewall step goes wrong, it still lets you log in.
  • Commands are shown as root. Once you switch to your new user (step 2), put sudo in front of them.
Do steps 3, 4 and 5 in order and test each one in a second SSH window before closing the first. That way a mistake never locks you out.

​
1. Update all packages

Reboot if the kernel was updated: reboot. On Ubuntu, the file /var/run/reboot-required exists when a reboot is needed; on AlmaLinux and Rocky, sudo dnf needs-restarting -r tells you. More in how to update Linux packages.

​
2. Create a user with sudo

Working as root all the time is risky: one typo can damage the system. Create a normal user and give it admin rights through sudo.
Test it in a new window: log in as alex and run sudo whoami; it should print root. Details in create a sudo user.

​
3. Log in with an SSH key

On your own computer, create a key and copy it to the new user:
Windows users: see the PowerShell method in create and use SSH keys.

​
4. Disable SSH password login

Once the key works, stop SSH accepting passwords:
Use sshd instead of ssh in the restart command on AlmaLinux and Rocky Linux. Full explanation and checks: disable SSH password login. You can also stop root logging in over SSH.

​
5. Turn on a firewall

A firewall decides which network connections reach your server. Allow SSH before you enable it.
If you changed the SSH port, allow that port instead, for example sudo ufw allow 2222/tcp.
Open more ports later as you install services (for example 80 and 443 for a website). Guides: UFW, firewalld.

​
6. Enable automatic security updates

Ubuntu Server ships with unattended-upgrades and installs security updates automatically. On Debian, install and switch it on:
Test without changing anything: sudo unattended-upgrade --dry-run -v.
More options in enable automatic security updates.

​
7. Set the timezone and hostname

timedatectl list-timezones shows every zone name. Correct time matters for logs, cron jobs and TLS certificates. See timezone and time sync and change the hostname. To show a proper name in reverse DNS, also set reverse DNS for your IP.

​
8. Block repeated login attempts

Even with passwords off, bots keep knocking. Fail2ban reads your logs and bans IPs that fail repeatedly:
Configure the SSH jail as shown in set up Fail2ban for SSH, or use CrowdSec.

​
9. Set up backups

Decide now how you would recover from a mistake or a disk failure: A backup you haven’t restored once is a hope, not a backup. Test a restore.

​
10. Check what is listening

List every service that accepts network connections:
On a fresh server you normally see only SSH (port 22) and possibly a local DNS resolver on 127.0.0.53. Anything you don’t recognise, look up before opening it in the firewall. See check open ports.

​
How to check it worked

From your computer:
  • ssh alex@203.0.113.10 logs in with your key, no password asked.
  • ssh -o PubkeyAuthentication=no alex@203.0.113.10 is refused with Permission denied (publickey).
  • On the server, sudo ufw status (or sudo firewall-cmd --list-all) shows only the ports you meant to open.

​
Frequently asked questions

​
Do I need to do all ten steps?

Steps 1 to 6 and 9 are essential for any internet-facing server. Steps 7, 8 and 10 take a few minutes and save trouble later.

​
Should I change the SSH port too?

It is optional. It reduces log noise but doesn’t replace keys and a firewall. See change the SSH port.

​
I locked myself out during these steps. What now?

Open the VNC console, log in with the root password and undo the last change (for example ufw allow OpenSSH or delete the file in /etc/ssh/sshd_config.d/). If you don’t know the root password, reset it.

​
What should I install next?

That depends on your project: a LEMP stack for websites, Docker for containers, or a game server.

VPS and dedicated server guides

Every guide in this section.

Linux security checklist

The full hardening list.

Create and use SSH keys

Step 3 in detail.

Set up UFW

Step 5 in detail.

Essential Linux commands

The basics.
Checked against the official Ubuntu Server documentation, Red Hat: Automating software updates and the OpenSSH manual on 4 November 2026; the SSH key, sshd_config.d and UFW (dry run) steps were tested on Ubuntu 24.04 LTS. Service restarts, timedatectl and the AlmaLinux steps were not tested.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026