---
title: "Initial VPS Setup (Debian/Ubuntu)"
description: "First steps after provisioning a new VPS: users, SSH keys, firewall, and system updates."
section: vps
order: 1
---

# Initial VPS Setup

This guide walks you through the first steps after provisioning a new Arcline VPS. You'll create a non-root user, harden SSH, set up a firewall, and apply system updates.

---

## Before you begin

You'll receive your VPS login credentials from Arcline after provisioning. Your initial login is as `root` via SSH.

```
ssh root@your.vps.ip.address
```

If you're on macOS or Linux, the SSH client is built in. On Windows, use PowerShell, Windows Terminal, or WSL.

---

## Step 1 — Create a non-root user

Working as root for daily tasks is risky. Create an administrative user:

```bash
adduser yourname
```

Follow the prompts to set a strong password. Then add the user to the `sudo` group:

```bash
usermod -aG sudo yourname
```

For Debian, the sudo group may be named differently. Verify with `groups yourname` — if you see `sudo`, you're set.

---

## Step 2 — Copy your SSH key

From your local machine (not the VPS), copy your SSH public key to the new user:

```bash
ssh-copy-id yourname@your.vps.ip.address
```

If `ssh-copy-id` isn't available, manually create the `.ssh` directory and `authorized_keys` file:

```bash
# On the VPS, as your new user:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
# Edit this file and paste your public key
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
```

Test that key-based login works from a new terminal:

```bash
ssh yourname@your.vps.ip.address
```

If you can log in without a password prompt, proceed.

---

## Step 3 — Harden SSH

Edit the SSH server configuration:

```bash
sudo nano /etc/ssh/sshd_config
```

Make the following changes:

```
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 22
```

If you changed the SSH port, note it — you'll need it in firewall rules below.

Restart SSH:

```bash
sudo systemctl restart sshd
```

Before closing your current session, open a **second terminal** and verify you can still log in as your new user. If something went wrong, you still have the root session to fix it.

---

## Step 4 — Set up the firewall (UFW)

UFW (Uncomplicated Firewall) is the easiest way to manage iptables rules on Ubuntu/Debian.

First, allow SSH so you don't lock yourself out:

```bash
sudo ufw allow ssh
```

If you changed the SSH port:

```bash
sudo ufw allow 2222/tcp   # replace 2222 with your port
```

For a web server, allow HTTP and HTTPS:

```bash
sudo ufw allow http
sudo ufw allow https
```

Enable the firewall:

```bash
sudo ufw enable
```

Check the status:

```bash
sudo ufw status verbose
```

Default deny on incoming, allow on outgoing is the correct policy. Only the ports you explicitly opened should be listed.

---

## Step 5 — Apply system updates

Keep the system current:

```bash
sudo apt update
sudo apt upgrade -y
```

Enable automatic security updates:

```bash
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
```

Select **Yes** when prompted about automatically installing security updates.

---

## Step 6 — Set the timezone and hostname

Set the correct timezone:

```bash
sudo timedatectl set-timezone America/New_York   # or your timezone
```

Verify with `timedatectl`.

Set a descriptive hostname:

```bash
sudo hostnamectl set-hostname myserver
```

Add it to `/etc/hosts`:

```bash
echo "127.0.1.1 myserver" | sudo tee -a /etc/hosts
```

---

## Step 7 — Install essential tools

A few packages you'll want on every server:

```bash
sudo apt install -y curl wget git htop net-tools ufw fail2ban
```

Fail2ban will be configured in a dedicated guide. For now it runs with sensible defaults.

---

## What's next

- [Install Nginx + PHP-FPM + MySQL](/vps/nginx-php-mysql/) for a LEMP stack
- [Deploy a static site](/vps/static-site/) with Nginx
- [Set up fail2ban](/vps/fail2ban/) for SSH brute-force protection