3.9 KiB
title, description, section, order
| title | description | section | order |
|---|---|---|---|
| Initial VPS Setup (Debian/Ubuntu) | First steps after provisioning a new VPS: users, SSH keys, firewall, and system updates. | vps | 1 |
Initial VPS Setup
This guide walks you through the first steps after provisioning a new Arcline VPS. You'll create a non-root user, harden SSH, set up a firewall, and apply system updates.
Before you begin
You'll receive your VPS login credentials from Arcline after provisioning. Your initial login is as root via SSH.
ssh root@your.vps.ip.address
If you're on macOS or Linux, the SSH client is built in. On Windows, use PowerShell, Windows Terminal, or WSL.
Step 1 — Create a non-root user
Working as root for daily tasks is risky. Create an administrative user:
adduser yourname
Follow the prompts to set a strong password. Then add the user to the sudo group:
usermod -aG sudo yourname
For Debian, the sudo group may be named differently. Verify with groups yourname — if you see sudo, you're set.
Step 2 — Copy your SSH key
From your local machine (not the VPS), copy your SSH public key to the new user:
ssh-copy-id yourname@your.vps.ip.address
If ssh-copy-id isn't available, manually create the .ssh directory and authorized_keys file:
# On the VPS, as your new user:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
# Edit this file and paste your public key
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
Test that key-based login works from a new terminal:
ssh yourname@your.vps.ip.address
If you can log in without a password prompt, proceed.
Step 3 — Harden SSH
Edit the SSH server configuration:
sudo nano /etc/ssh/sshd_config
Make the following changes:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 22
If you changed the SSH port, note it — you'll need it in firewall rules below.
Restart SSH:
sudo systemctl restart sshd
Before closing your current session, open a second terminal and verify you can still log in as your new user. If something went wrong, you still have the root session to fix it.
Step 4 — Set up the firewall (UFW)
UFW (Uncomplicated Firewall) is the easiest way to manage iptables rules on Ubuntu/Debian.
First, allow SSH so you don't lock yourself out:
sudo ufw allow ssh
If you changed the SSH port:
sudo ufw allow 2222/tcp # replace 2222 with your port
For a web server, allow HTTP and HTTPS:
sudo ufw allow http
sudo ufw allow https
Enable the firewall:
sudo ufw enable
Check the status:
sudo ufw status verbose
Default deny on incoming, allow on outgoing is the correct policy. Only the ports you explicitly opened should be listed.
Step 5 — Apply system updates
Keep the system current:
sudo apt update
sudo apt upgrade -y
Enable automatic security updates:
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
Select Yes when prompted about automatically installing security updates.
Step 6 — Set the timezone and hostname
Set the correct timezone:
sudo timedatectl set-timezone America/New_York # or your timezone
Verify with timedatectl.
Set a descriptive hostname:
sudo hostnamectl set-hostname myserver
Add it to /etc/hosts:
echo "127.0.1.1 myserver" | sudo tee -a /etc/hosts
Step 7 — Install essential tools
A few packages you'll want on every server:
sudo apt install -y curl wget git htop net-tools ufw fail2ban
Fail2ban will be configured in a dedicated guide. For now it runs with sensible defaults.
What's next
- Install Nginx + PHP-FPM + MySQL for a LEMP stack
- Deploy a static site with Nginx
- Set up fail2ban for SSH brute-force protection