What should you do in the first ten minutes on a new Linux VPS?

Which image should you pick before the first login?

Pick the release that gets security fixes the longest, because a reinstall later costs you the disk. The images on offer are Debian 13, Debian 12, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, AlmaLinux 10, Rocky Linux 10. Their support windows differ:

• Debian 13 came out on 9 August 2025 and is the current stable release.
• Debian 12 passed to the Debian LTS team on 11 June 2026; LTS covers it until 30 June 2028.
• Ubuntu 24.04 LTS gets standard security maintenance until May 2029, Ubuntu 22.04 LTS until May 2027.

For a new server, Debian 13 or Ubuntu 24.04 gives the longest runway, and every command below works on both. AlmaLinux 10 and Rocky Linux 10 use dnf and firewalld; each step gives their variant. Changing your mind later means a reinstall. Reboot, reinstall and delete are requests you send from the dashboard, carried out by a person. A reinstall erases the disk.

How do you log in the first time?

You log in as root over SSH. Add a public key at checkout and password login stays disabled; skip it and the team sets a temporary root password, shown in your dashboard, that you change with passwd the first time you log in. Your dashboard shows the IP address once the VPS is built.

On the first connection, ssh prints the server's host key fingerprint and asks you to accept it. After that it lives in ~/.ssh/known_hosts on your computer. If ssh later warns that the host key changed, find out why before you delete the old line: a reinstall explains it, nothing else should. SSH keys and server security shows how to compare fingerprints.

ssh [email protected]

# only if you logged in with the temporary root password
passwd

# name the machine and keep its clock in UTC
hostnamectl set-hostname web1
timedatectl set-timezone UTC

How do you patch the system?

Install every pending update before you install anything else. An image is built once and then ages; the packages in it are as old as the image. A new kernel only runs after a reboot, so reboot now, while no service depends on the machine yet.

# Debian, Ubuntu
apt update && apt full-upgrade -y

# AlmaLinux, Rocky Linux
dnf upgrade --refresh -y

# running kernel vs installed kernels
uname -r && ls /boot | grep vmlinuz
reboot

How do you add a sudo user and stop working as root?

Create one named user with sudo rights and give it the same key. Root stays reachable through sudo, and the logs then show which person did what when a second admin joins. Test the new login in a second terminal and keep the first one open until it works.

If you skipped the key at checkout, run ssh-copy-id [email protected] from your computer instead of the copy below: password login is still on at that point, so it can install the key for you.

adduser alice                  # AlmaLinux, Rocky: useradd -m alice && passwd alice
usermod -aG sudo alice         # AlmaLinux, Rocky: usermod -aG wheel alice

# reuse the key you gave at checkout
install -d -m 700 -o alice -g alice /home/alice/.ssh
install -m 600 -o alice -g alice /root/.ssh/authorized_keys /home/alice/.ssh/authorized_keys

# then, in a second terminal on your computer
ssh [email protected]
sudo -v

How do you switch password login off?

Put three lines in a drop-in file whose name sorts first, then test the syntax before you restart sshd. For most keywords sshd keeps the first value it reads, and Debian and Ubuntu read /etc/ssh/sshd_config.d/*.conf at the top of the main file. A file named 00-hardening.conf therefore wins over any later file that says the opposite. sshd -T prints the values the daemon will really use. The reasoning and the traps are in SSH keys and server security.

cat > /etc/ssh/sshd_config.d/00-hardening.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
EOF

sshd -t && systemctl restart ssh     # AlmaLinux, Rocky: systemctl restart sshd
sshd -T | grep -Ei '^(passwordauthentication|permitrootlogin)'

Which firewall rules should a new VPS have?

Allow SSH, refuse the rest, and add a port only when a service needs it. First list what already listens with ss -tulpn; a fresh image usually shows sshd and little else. Each VPS comes with a dedicated IPv4 address and a routed IPv6 /64. Every plan lists its outbound traffic per month in TB, and going over it never triggers an automatic charge. A firewall that covers IPv4 alone leaves the IPv6 side open; ufw writes rules for both families when IPV6=yes is set in /etc/default/ufw, which is how Debian and Ubuntu ship it.

Allow port 22 before ufw enable, or new SSH logins are refused.

ss -tulpn

apt install ufw
ufw allow 22/tcp
ufw enable
ufw status verbose

# AlmaLinux, Rocky Linux (firewalld is already running)
firewall-cmd --list-all

How do you keep security updates coming without thinking about it?

Let the system install security updates every day. On Debian and Ubuntu that is unattended-upgrades; Ubuntu usually ships it on, and apt tells you when it is already installed. On AlmaLinux and Rocky Linux it is dnf-automatic with apply_updates = yes in /etc/dnf/automatic.conf. Kernel updates still wait for a reboot, so put one in your calendar each month.

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
unattended-upgrade -d          # one manual run with debug output

# AlmaLinux, Rocky Linux
dnf install dnf-automatic
systemctl enable --now dnf-automatic.timer

What else belongs in the first ten minutes?

Four small things save trouble later:

• Swap on small plans. A 1 GB swap file keeps a package upgrade or a build from being killed for lack of memory on 1 or 2 GB of RAM.
• /tmp on Debian 13. Debian 13 keeps /tmp in RAM and lets it grow to 50% of memory. On a small VPS, a large temporary file then competes with your services. systemctl mask tmp.mount and a reboot put /tmp back on disk.
• Mail. Outbound port 25 is closed on every VPS and is not opened on request; send mail through a mail provider on port 465 or 587. Set this up before the first app tries to send a password reset.
• Backups. No plan includes backups, so keep your own copy of anything that matters. Decide today where the copy goes, then test one restore; migrate a Linux VPS shows the rsync and database commands.

fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab
free -h

Which plan fits a first Linux server?

Byte is enough to learn on and to run one small service; move up when RAM, not CPU, runs short. The vCPU of every plan are shared: they are scheduled on physical cores that neighbouring VPS also use. The RAM and NVMe space of your plan are reserved for your VPS only. Each plan costs the same in all six cities. The "good first use" column is a starting point from the RAM and disk of each plan, not a measurement.