# What should you do in the first ten minutes on a new Linux VPS?

> What to do in the first 10 minutes on a new Linux VPS: patch, add a sudo user and SSH key, turn off passwords, set a firewall. Debian 13 and Ubuntu 24.04.

- URL: https://vpswithcrypto.com/first-ten-minutes-on-a-linux-vps/
- Last updated: 2026-11-03
- Publisher: VPS With Crypto (https://vpswithcrypto.com)

A first-login checklist for Debian 13, Debian 12 and Ubuntu 24.04: change the temporary password, patch the system, add a sudo user, switch password login off, open only the ports you use and plan your backups. Notes for AlmaLinux and Rocky Linux where the commands differ.

**Quick answer — What should I do first on a new Linux VPS?**

Log in, change the temporary root password if you got one, patch the system, add a sudo user with an SSH key, switch password login off, open only port 22 and turn on automatic security updates. On a VPS With Crypto VPS that is about 10 commands, written here for Debian 13 and Ubuntu 24.04 and checked on 3 November 2026.

## Which image should you pick before the first login?

**Pick the release that gets security fixes the longest, because a reinstall later costs you the disk.** The images on offer are Debian 13, Debian 12, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, AlmaLinux 10, Rocky Linux 10. Their support windows differ:

- **Debian 13** came out on 9 August 2025 and is the current stable release.
- **Debian 12** passed to the Debian LTS team on 11 June 2026; LTS covers it until 30 June 2028.
- **Ubuntu 24.04 LTS** gets standard security maintenance until May 2029, **Ubuntu 22.04 LTS** until May 2027.

For a new server, Debian 13 or Ubuntu 24.04 gives the longest runway, and every command below works on both. AlmaLinux 10 and Rocky Linux 10 use `dnf` and firewalld; each step gives their variant. Changing your mind later means a reinstall. Reboot, reinstall and delete are requests you send from the dashboard, carried out by a person. A reinstall erases the disk.

## How do you log in the first time?

You log in as root over SSH. Add a public key at checkout and password login stays disabled; skip it and the team sets a temporary root password, shown in your dashboard, that you change with passwd the first time you log in. Your dashboard shows the IP address once the VPS is built.

On the first connection, `ssh` prints the server's host key fingerprint and asks you to accept it. After that it lives in `~/.ssh/known_hosts` on your computer. If `ssh` later warns that the host key changed, find out why before you delete the old line: a reinstall explains it, nothing else should. [SSH keys and server security](https://vpswithcrypto.com/ssh-keys-and-server-security/ "How do you set up SSH keys and lock down SSH on a Linux VPS?") shows how to compare fingerprints.

*First login from your own computer*

```bash
ssh root@203.0.113.10

# only if you logged in with the temporary root password
passwd

# name the machine and keep its clock in UTC
hostnamectl set-hostname web1
timedatectl set-timezone UTC
```

## How do you patch the system?

**Install every pending update before you install anything else.** An image is built once and then ages; the packages in it are as old as the image. A new kernel only runs after a reboot, so reboot now, while no service depends on the machine yet.

*Update everything, then reboot if a kernel came in*

```bash
# Debian, Ubuntu
apt update && apt full-upgrade -y

# AlmaLinux, Rocky Linux
dnf upgrade --refresh -y

# running kernel vs installed kernels
uname -r && ls /boot | grep vmlinuz
reboot
```

## How do you add a sudo user and stop working as root?

**Create one named user with sudo rights and give it the same key.** Root stays reachable through `sudo`, and the logs then show which person did what when a second admin joins. Test the new login in a second terminal and keep the first one open until it works.

If you skipped the key at checkout, run `ssh-copy-id alice@203.0.113.10` from your computer instead of the copy below: password login is still on at that point, so it can install the key for you.

*A sudo user that logs in with your key*

```bash
adduser alice                  # AlmaLinux, Rocky: useradd -m alice && passwd alice
usermod -aG sudo alice         # AlmaLinux, Rocky: usermod -aG wheel alice

# reuse the key you gave at checkout
install -d -m 700 -o alice -g alice /home/alice/.ssh
install -m 600 -o alice -g alice /root/.ssh/authorized_keys /home/alice/.ssh/authorized_keys

# then, in a second terminal on your computer
ssh alice@203.0.113.10
sudo -v
```

## How do you switch password login off?

**Put three lines in a drop-in file whose name sorts first, then test the syntax before you restart sshd.** For most keywords sshd keeps the first value it reads, and Debian and Ubuntu read `/etc/ssh/sshd_config.d/*.conf` at the top of the main file. A file named `00-hardening.conf` therefore wins over any later file that says the opposite. `sshd -T` prints the values the daemon will really use. The reasoning and the traps are in [SSH keys and server security](https://vpswithcrypto.com/ssh-keys-and-server-security/ "How do you set up SSH keys and lock down SSH on a Linux VPS?").

*Keys only, no root login over SSH*

```bash
cat > /etc/ssh/sshd_config.d/00-hardening.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
EOF

sshd -t && systemctl restart ssh     # AlmaLinux, Rocky: systemctl restart sshd
sshd -T | grep -Ei '^(passwordauthentication|permitrootlogin)'
```

## Which firewall rules should a new VPS have?

**Allow SSH, refuse the rest, and add a port only when a service needs it.** First list what already listens with `ss -tulpn`; a fresh image usually shows `sshd` and little else. Each VPS comes with a dedicated IPv4 address and a routed IPv6 /64. Every plan lists its outbound traffic per month in TB, and going over it never triggers an automatic charge. A firewall that covers IPv4 alone leaves the IPv6 side open; ufw writes rules for both families when `IPV6=yes` is set in `/etc/default/ufw`, which is how Debian and Ubuntu ship it.

Allow port 22 before `ufw enable`, or new SSH logins are refused.

*ufw on Debian and Ubuntu, firewalld on AlmaLinux and Rocky*

```bash
ss -tulpn

apt install ufw
ufw allow 22/tcp
ufw enable
ufw status verbose

# AlmaLinux, Rocky Linux (firewalld is already running)
firewall-cmd --list-all
```

## How do you keep security updates coming without thinking about it?

**Let the system install security updates every day.** On Debian and Ubuntu that is `unattended-upgrades`; Ubuntu usually ships it on, and `apt` tells you when it is already installed. On AlmaLinux and Rocky Linux it is `dnf-automatic` with `apply_updates = yes` in `/etc/dnf/automatic.conf`. Kernel updates still wait for a reboot, so put one in your calendar each month.

*Daily security updates*

```bash
apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
unattended-upgrade -d          # one manual run with debug output

# AlmaLinux, Rocky Linux
dnf install dnf-automatic
systemctl enable --now dnf-automatic.timer
```

## What else belongs in the first ten minutes?

Four small things save trouble later:

- **Swap on small plans.** A 1 GB swap file keeps a package upgrade or a build from being killed for lack of memory on 1 or 2 GB of RAM.
- **/tmp on Debian 13.** Debian 13 keeps `/tmp` in RAM and lets it grow to 50% of memory. On a small VPS, a large temporary file then competes with your services. `systemctl mask tmp.mount` and a reboot put `/tmp` back on disk.
- **Mail.** Outbound port 25 is closed on every VPS and is not opened on request; send mail through a mail provider on port 465 or 587. Set this up before the first app tries to send a password reset.
- **Backups.** No plan includes backups, so keep your own copy of anything that matters. Decide today where the copy goes, then test one restore; [migrate a Linux VPS](https://vpswithcrypto.com/migrate-a-linux-vps/ "How do you migrate a Linux VPS to a new host without losing data?") shows the rsync and database commands.

*A 1 GB swap file*

```bash
fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab
free -h
```

## Which plan fits a first Linux server?

**Byte is enough to learn on and to run one small service; move up when RAM, not CPU, runs short.** The vCPU of every plan are shared: they are scheduled on physical cores that neighbouring VPS also use. The RAM and NVMe space of your plan are reserved for your VPS only. Each plan costs the same in all six cities. The "good first use" column is a starting point from the RAM and disk of each plan, not a measurement.

*Sizes and prices of VPS With Crypto plans, the same in New York, Dallas, Los Angeles, London, Amsterdam and Frankfurt.*

| Plan | vCPU / RAM / NVMe | Month to month | A month on 12 months | Good first use |
| --- | --- | --- | --- | --- |
| Byte | 1 vCPU / 2 GB / 40 GB | $3.21 | $2.25 | A first server, a static site, a WireGuard endpoint |
| Kilo | 2 vCPU / 4 GB / 65 GB | $6.42 | $4.49 | WordPress with its database, a few containers |
| Mega | 2 vCPU / 6 GB / 120 GB | $9.64 | $6.75 | Nextcloud for a household, several small sites |
| Giga | 4 vCPU / 8 GB / 160 GB | $19.28 | $13.50 | An app and its database side by side, CI builds |
| Tera | 8 vCPU / 24 GB / 400 GB | $29.46 | $20.62 | Many containers, large datasets kept in RAM |

## What else do people ask about a new VPS?

### Should I move SSH off port 22?

It cuts the noise from scanners in your logs; it does not stop anyone who looks for SSH elsewhere. Key-only login is what makes password guessing useless. If you move it on Ubuntu 24.04, sshd is started by `ssh.socket`, so the change also needs `systemctl daemon-reload` and `systemctl restart ssh.socket`, and the firewall must allow the new port first.

### Do I need fail2ban once passwords are off?

Not for safety: with keys only, guessed passwords fail anyway. It keeps logs shorter. Debian 12 and 13 no longer install rsyslog by default and log to the systemd journal, so set `backend = systemd` for the sshd jail.

### What if I lock myself out?

Prevention is the plan: change SSH and firewall rules with a second session open, and test a new login before closing the first. Reboot, reinstall and delete are requests you send from the dashboard, carried out by a person. A reinstall erases the disk.

### Can I install Windows or another distribution?

Every VPS runs Linux, installed from our Debian, Ubuntu, AlmaLinux or Rocky Linux images; Windows is not sold. The images you can pick are Debian 13, Debian 12, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, AlmaLinux 10, Rocky Linux 10.

### Does VPS With Crypto back up my VPS?

No. No plan includes backups, so keep your own copy of anything that matters. A nightly copy of your data and a database dump to another machine covers most small servers.

**Start from a clean Debian 13 or Ubuntu 24.04 VPS** Byte is $2.25 a month on a 12-month term or $3.21 month to month, the same in all six cities. A team member sets up every VPS by hand after your payment confirms, within 24 hours; your dashboard follows the build and then shows the IP address. [See plans and prices](https://vpswithcrypto.com/pricing/ "How much does a VPS With Crypto server cost per month?") · [How ordering works](https://vpswithcrypto.com/how-it-works/ "How do I order a VPS with crypto, from payment to SSH?")

## Sources

1. [Debian 13 release notes: issues to be aware of (/tmp on tmpfs, sysctl.conf)](https://www.debian.org/releases/trixie/release-notes/issues.en.html) — Debian (read 2026-11-03)
2. [Debian 12 release notes: changes to system logging](https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html) — Debian (read 2026-11-03)
3. [Debian Long Term Support (LTS schedule)](https://wiki.debian.org/LTS) — Debian Wiki (read 2026-11-03)
4. [Ubuntu release cycle](https://ubuntu.com/about/release-cycle) — Canonical (read 2026-11-03)
5. [sshd_config(5)](https://man.openbsd.org/sshd_config) — OpenBSD / OpenSSH (read 2026-11-03)
6. [OpenSSH server (drop-ins in sshd_config.d, sshd -t)](https://ubuntu.com/server/docs/how-to/security/openssh-server/) — Canonical (read 2026-11-03)
7. [SSHd now uses socket-based activation (Ubuntu 22.10 and later)](https://discourse.ubuntu.com/t/sshd-now-uses-socket-based-activation-ubuntu-22-10-and-later/30189) — Ubuntu Discourse (read 2026-11-03)
8. [Firewalls (ufw)](https://ubuntu.com/server/docs/how-to/security/firewalls/) — Canonical (read 2026-11-03)
9. [UnattendedUpgrades](https://wiki.debian.org/UnattendedUpgrades) — Debian Wiki (read 2026-11-03)

---

VPS With Crypto: VPS With Crypto sells Linux KVM VPS in New York, Dallas, Los Angeles, London, Amsterdam and Frankfurt, paid in crypto with no ID upload. The business behind it is DomaineGoat LLC, registered in Panama. A plan costs the same in all six cities, and on a 12-month term it is priced at least 25% under a named comparable plan, chosen among 34 no-KYC crypto hosts and read on 3 November 2026.