First steps on a new VPS: SSH keys, firewall and updates

Updated 4 November 2026

The first 15 minutes on a new VPS: log in with SSH, switch from a password to an SSH key, turn off password logins, switch on a firewall that only lets SSH in, and install updates. After that your server is no longer an easy target for the bots that try passwords on every public IP address all day long.

The commands below are for Ubuntu 24.04 and Debian 12/13, with the differences for Rocky Linux 9 and AlmaLinux 9 where they matter. Checked on 29 October 2026 against the Ubuntu Server documentation (ufw), the OpenSSH manual pages and the Docker documentation.

1. Log in for the first time

1. After payment you get an email. Your IP address and root password are in the customer portal.
2. Open a terminal. On Windows 10 and 11 that is PowerShell or Windows Terminal (SSH is built in); on macOS and Linux it is Terminal.
3. Type ssh root@your-ip, answer yes to the fingerprint question and enter the password. You set a new password on first login.

2. Make an SSH key on your own computer

A key is a pair of files: a private key that stays on your computer and a public key that you put on the server. Nobody can guess it like a password.

ssh-keygen -t ed25519

Press Enter to keep the default location and choose a passphrase (recommended). You now have id_ed25519 (private, never share it) and id_ed25519.pub (public) in the .ssh folder in your home folder.

3. Put the public key on the server

macOS and Linux:

ssh-copy-id root@your-ip

Windows (PowerShell) has no ssh-copy-id, so use:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@your-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Now open a new terminal and run ssh root@your-ip. If it logs you in without asking for the server password (only your key passphrase, if you set one), the key works.

4. Turn off password logins

Create a small settings file. SSH reads the files in /etc/ssh/sshd_config.d/ in alphabetical order and uses the first value it finds for each setting, so a name starting with 10- wins over files such as 50-cloud-init.conf that may switch passwords back on.

cat > /etc/ssh/sshd_config.d/10-keys-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF
sshd -t && sshd -T | grep -E 'passwordauthentication|permitrootlogin'

sshd -t checks the config for mistakes; the second command should print passwordauthentication no and permitrootlogin without-password (the same thing under its older name). Then restart SSH:

systemctl restart ssh      # Ubuntu and Debian
systemctl restart sshd     # Rocky Linux and AlmaLinux

Test again in a new window. A login with a password should now be refused.

5. Switch on a firewall

Ubuntu and Debian use ufw. On Ubuntu it is installed but off; on Debian install it first with apt install ufw. Always allow SSH before you enable it:

ufw allow OpenSSH          # or: ufw allow 22/tcp
ufw enable
ufw status verbose

Open more ports only for what you really run, for example ufw allow 80,443/tcp for a website or ufw allow 51820/udp for WireGuard. A Discord bot needs no open ports: it connects out to Discord.

Rocky Linux and AlmaLinux use firewalld:

dnf install -y firewalld && systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

6. Install updates and keep them coming

apt update && apt full-upgrade -y          # Ubuntu and Debian
dnf upgrade -y                              # Rocky Linux and AlmaLinux

Automatic security updates: on Ubuntu, unattended-upgrades is normally already on (check with systemctl status unattended-upgrades). On Debian, run apt install unattended-upgrades. On Rocky and AlmaLinux, install dnf-automatic and set apply_updates = yes in /etc/dnf/automatic.conf, then systemctl enable --now dnf-automatic.timer. Reboot when a new kernel was installed; you can also do that from the portal.

7. Optional, but worth it

• A normal user for daily work: adduser yourname, usermod -aG sudo yourname (Rocky/Alma: group wheel) and copy your key to it. Then set PermitRootLogin no.
• Fail2ban blocks IP addresses that keep failing to log in. With passwords off it is mostly about cleaner logs.
• Backups. A VPS has no backups included, so set them up yourself: see Back up your VPS with restic.

What it costs

VPS S has 2 vCPU, 4 GB RAM, 40 GB NVMe, 20 TB traffic and its own IPv4 address plus IPv6, in a data center in Germany. It costs €7.99 per month paid per quarter, or €8.29 with monthly billing. See VPS hosting. Only want to run a Discord bot or a game server? Then you don't need to do any of this: see game server on a VPS or game hosting.

Frequently asked questions