> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What to Do After Setting Up a New Linux VPS (First 10 Steps)

> What to do after setting up a new Linux VPS: update, create a sudo user, add SSH keys, disable passwords, enable a firewall and auto-updates, then back up.

After setting up a new Linux VPS, log in as root and, in this order: update all packages, create a normal user with sudo, add your SSH key, disable SSH password login, turn on a firewall that allows SSH, enable automatic security updates, set the timezone and hostname, add Fail2ban, set up backups, and check what is listening. The whole list takes about 30 to 45 minutes on Ubuntu 24.04, Debian 13 or AlmaLinux / Rocky Linux 9 or 10.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 30 to 45 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root login, an SSH client |

## Before you start

* [SSH into your server](https://help.freakhosting.com/portals/other/how-to-connect-to-a-linux-server-with-ssh.md) as root.
* Keep the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) in mind: if an SSH or firewall step goes wrong, it still lets you log in.
* Commands are shown as root. Once you switch to your new user (step 2), put `sudo` in front of them.

> [!WARNING]
>
> Do steps 3, 4 and 5 in order and test each one in a **second** SSH window before closing the first. That way a mistake never locks you out.

## 1. Update all packages

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> apt update && apt full-upgrade -y
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> dnf upgrade -y
> ```

Reboot if the kernel was updated: `reboot`. On Ubuntu, the file `/var/run/reboot-required` exists when a reboot is needed; on AlmaLinux and Rocky, `sudo dnf needs-restarting -r` tells you. More in [how to update Linux packages](https://help.freakhosting.com/portals/other/how-to-update-linux-packages.md).

## 2. Create a user with sudo

Working as root all the time is risky: one typo can damage the system. Create a normal user and give it admin rights through `sudo`.

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> adduser alex
> usermod -aG sudo alex
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> useradd -m alex
> passwd alex
> usermod -aG wheel alex
> ```

Test it in a new window: log in as `alex` and run `sudo whoami`; it should print `root`. Details in [create a sudo user](https://help.freakhosting.com/portals/other/how-to-create-a-sudo-user-on-linux.md).

## 3. Log in with an SSH key

On your own computer, create a key and copy it to the new user:

```bash theme={null}
ssh-keygen -t ed25519 -C "alex@laptop"
ssh-copy-id alex@203.0.113.10
```

Windows users: see the PowerShell method in [create and use SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md).

## 4. Disable SSH password login

Once the key works, stop SSH accepting passwords:

```bash theme={null}
printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\n' | sudo tee /etc/ssh/sshd_config.d/00-disable-passwords.conf
sudo sshd -t && sudo systemctl restart ssh
```

Use `sshd` instead of `ssh` in the restart command on AlmaLinux and Rocky Linux. Full explanation and checks: [disable SSH password login](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md). You can also [stop root logging in over SSH](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md).

## 5. Turn on a firewall

A firewall decides which network connections reach your server. Allow SSH **before** you enable it.

> [tab] Ubuntu / Debian (UFW)
>
> ```bash theme={null}
> sudo apt install ufw
> sudo ufw allow OpenSSH
> sudo ufw enable
> sudo ufw status
> ```
>
> If you [changed the SSH port](https://help.freakhosting.com/portals/other/how-to-change-the-ssh-port.md), allow that port instead, for example `sudo ufw allow 2222/tcp`.

> [tab] AlmaLinux / Rocky (firewalld)
>
> firewalld is the standard firewall on AlmaLinux and Rocky Linux. Make sure it runs, then allow SSH:
>
> ```bash theme={null}
> sudo systemctl enable --now firewalld
> sudo firewall-cmd --list-all
> sudo firewall-cmd --permanent --add-service=ssh
> sudo firewall-cmd --reload
> ```

Open more ports later as you install services (for example `80` and `443` for a website). Guides: [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md), [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md).

## 6. Enable automatic security updates

> [tab] Ubuntu / Debian
>
> Ubuntu Server ships with `unattended-upgrades` and installs security updates automatically. On Debian, install and switch it on:
>
> ```bash theme={null}
> sudo apt install unattended-upgrades
> sudo dpkg-reconfigure -plow unattended-upgrades
> ```
>
> Test without changing anything: `sudo unattended-upgrade --dry-run -v`.

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install dnf-automatic
> sudo systemctl enable --now dnf-automatic-install.timer
> ```

More options in [enable automatic security updates](https://help.freakhosting.com/portals/other/how-to-enable-automatic-security-updates.md).

## 7. Set the timezone and hostname

```bash theme={null}
sudo timedatectl set-timezone Europe/London
sudo hostnamectl set-hostname web01
timedatectl
```

`timedatectl list-timezones` shows every zone name. Correct time matters for logs, cron jobs and TLS certificates. See [timezone and time sync](https://help.freakhosting.com/portals/other/how-to-set-the-timezone-and-time-sync-on-linux.md) and [change the hostname](https://help.freakhosting.com/portals/other/how-to-change-the-hostname-on-linux.md). To show a proper name in reverse DNS, also [set reverse DNS](https://help.freakhosting.com/portals/vps-panel/how-to-configure-reverse-dns.md) for your IP.

## 8. Block repeated login attempts

Even with passwords off, bots keep knocking. Fail2ban reads your logs and bans IPs that fail repeatedly:

```bash theme={null}
sudo apt install fail2ban        # Ubuntu / Debian
sudo dnf install epel-release && sudo dnf install fail2ban   # AlmaLinux / Rocky
```

Configure the SSH jail as shown in [set up Fail2ban for SSH](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md), or use [CrowdSec](https://help.freakhosting.com/portals/other/how-to-install-crowdsec-on-linux.md).

## 9. Set up backups

Decide now how you would recover from a mistake or a disk failure:

* On a VPS, [schedule panel backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md).
* Keep a second copy of important data off the server, for example with [restic](https://help.freakhosting.com/portals/other/how-to-make-encrypted-backups-with-restic.md) or [rclone](https://help.freakhosting.com/portals/other/how-to-back-up-to-cloud-storage-with-rclone.md).

A backup you haven't restored once is a hope, not a backup. Test a restore.

## 10. Check what is listening

List every service that accepts network connections:

```bash theme={null}
sudo ss -tulpn
```

On a fresh server you normally see only SSH (port `22`) and possibly a local DNS resolver on `127.0.0.53`. Anything you don't recognise, look up before opening it in the firewall. See [check open ports](https://help.freakhosting.com/portals/other/how-to-check-open-ports-on-linux.md).

## How to check it worked

From your computer:

* `ssh alex@203.0.113.10` logs in with your key, no password asked.
* `ssh -o PubkeyAuthentication=no alex@203.0.113.10` is refused with `Permission denied (publickey)`.
* On the server, `sudo ufw status` (or `sudo firewall-cmd --list-all`) shows only the ports you meant to open.

## Frequently asked questions

### Do I need to do all ten steps?

Steps 1 to 6 and 9 are essential for any internet-facing server. Steps 7, 8 and 10 take a few minutes and save trouble later.

### Should I change the SSH port too?

It is optional. It reduces log noise but doesn't replace keys and a firewall. See [change the SSH port](https://help.freakhosting.com/portals/other/how-to-change-the-ssh-port.md).

### I locked myself out during these steps. What now?

Open the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md), log in with the root password and undo the last change (for example `ufw allow OpenSSH` or delete the file in `/etc/ssh/sshd_config.d/`). If you don't know the root password, [reset it](https://help.freakhosting.com/portals/vps-panel/how-to-reset-your-vps-root-password.md).

### What should I install next?

That depends on your project: a [LEMP stack](https://help.freakhosting.com/portals/other/how-to-install-a-lemp-stack.md) for websites, [Docker](https://help.freakhosting.com/portals/other/how-to-install-docker.md) for containers, or a [game server](https://help.freakhosting.com/portals/other/how-to-host-game-servers-with-linuxgsm.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Linux security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> The full hardening list.

> [card] [Create and use SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md)
>
> Step 3 in detail.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Step 5 in detail.

> [card] [Essential Linux commands](https://help.freakhosting.com/portals/other/essential-linux-commands-for-server-beginners.md)
>
> The basics.

***

> [!NOTE]
>
> **Checked against the official [Ubuntu Server documentation](https://ubuntu.com/server/docs/how-to/software/automatic-updates/), [Red Hat: Automating software updates](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/managing_software_with_the_dnf_tool/automating-software-updates-in-rhel) and the [OpenSSH manual](https://man.openbsd.org/sshd_config)** on 4 November 2026; the SSH key, `sshd_config.d` and UFW (dry run) steps were tested on Ubuntu 24.04 LTS. Service restarts, `timedatectl` and the AlmaLinux steps were not tested.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.