VPS Setup Guide: First-Hour Checklist for Ubuntu and AlmaLinux

You just bought a VPS. You have an IP address, a root password, and a blinking cursor. Now what?

What is VPS setup? VPS setup is the first round of work on a new virtual private server. You secure SSH access, create a non-root admin user, install updates and turn on a firewall. It takes about an hour and should happen before you install any website or app.

This VPS setup guide walks you through the first hour on a fresh server, step by step. If you are wondering how to configure a VPS server safely, this is the order we recommend for both Ubuntu and AlmaLinux. You will connect over SSH, lock down the root user, create a sudo user, install updates, and switch on a firewall. Then you will add swap, set the timezone, and turn on automatic security patches.

Why the hurry? A server with a public IP can get SSH login attempts within minutes. In one Sophos test, the first attempt came in under a minute (details below).

Bottom line: the 8-step new VPS checklist

If you only read one part, read this. In your first hour, do these eight things in order:

1. Connect with SSH as root, using the IP and password (or key) from your provider.

2. Update the system with apt on Ubuntu or dnf on AlmaLinux.

3. Create a normal user and give it sudo rights.

4. Set up SSH key login for that user.

5. Turn off root login and password login over SSH.

6. Enable a firewall (UFW on Ubuntu, firewalld on AlmaLinux) and allow SSH first.

7. Add swap, set the timezone and hostname.

8. Turn on automatic security updates, then reboot and test.

Key takeaway: Always test your new SSH login in a second window before you close the first one. It saves you from the most common lockout of all.

What do you need before you set up a VPS?

Short answer: your server's IP address, the root login details, and a terminal app. Your provider sends these by email or shows them in the client area after the order. Keep them handy:

• IP address, for example 203.0.113.10 (this is a sample address, not a real server)

• Root password or an SSH key you added during the order

• Operating system: this guide covers Ubuntu 26.04 LTS and AlmaLinux 10. Older versions such as Ubuntu 24.04 and AlmaLinux 9 use almost the same commands.

• A terminal: Terminal on macOS and Linux, or PowerShell on Windows 10 and 11

Not sure which OS to pick? Ubuntu 26.04 LTS, made by Canonical, gets standard updates until April 2031 and has a huge library of tutorials. AlmaLinux 10 is a free system built to match Red Hat Enterprise Linux (RHEL), so it suits teams used to Red Hat tools. Still deciding whether you need a VPS at all? Our shared hosting vs VPS comparison helps.

How do I connect to my VPS using SSH?

Short answer: to SSH into your VPS, open a terminal and run ssh root@YOUR_SERVER_IP, then type "yes" to trust the server and enter your password.

SSH (Secure Shell) is an encrypted remote login. Nearly every Linux server runs OpenSSH, and the same client is built into macOS, Linux and Windows. By default it listens on port 22.

On macOS or Linux

ssh root@203.0.113.10

The first time, SSH shows a "fingerprint" and asks if you want to continue. Type yes. Then paste your root password. The screen stays blank while you type the password. That is normal.

On Windows (PowerShell or PuTTY)

Windows 10 and 11 include an OpenSSH client, so the same ssh root@IP command works in PowerShell. Prefer a graphical app? A PuTTY VPS login takes three steps with PuTTY:

1. Open PuTTY and type your IP in "Host Name".

2. Keep port 22 and connection type SSH.

3. Click Open, accept the host key, then log in as root.

What should I do first after buying a VPS?

Short answer: update every package before you install anything else.

Provider images are built ahead of time, so they may miss recent patches. Updating first closes known security holes.

Ubuntu:

apt update && apt upgrade -y

AlmaLinux:

dnf upgrade -y

If the update installs a new kernel, reboot with reboot and log back in after a minute.

How do I create a sudo user on a VPS?

Short answer: add a new user, then put it in the sudo group on Ubuntu or the wheel group on AlmaLinux. Root can change anything, with no warning. One wrong command can wipe the system. A normal user has to type sudo and a password for admin tasks, which adds a pause before risky changes.

Ubuntu:

adduser ahmed
usermod -aG sudo ahmed

AlmaLinux:

adduser ahmed
passwd ahmed
usermod -aG wheel ahmed

Replace ahmed with your own username. Test it with su - ahmed and then sudo whoami. If it prints root, sudo works.

How do I set up SSH key login?

Short answer: create a key pair on your own computer, then copy the public key to the server.

Bots can guess passwords. They cannot realistically guess an Ed25519 key, and the private half never leaves your computer. On your own computer (not the server), run:

ssh-keygen -t ed25519 -C "you@example.com"
ssh-copy-id ahmed@203.0.113.10

Adding the key by hand on Windows

Windows usually does not include ssh-copy-id. You have two options.

Option 1: one command from PowerShell (easiest). Your new user can still log in with a password at this point, so run this on your PC:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh ahmed@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

It copies the key and sets the right permissions in one go. Because it runs as ahmed, the files belong to the right user.

Option 2: paste the key manually.

1. On your PC, open C:\Users\YOU\.ssh\id_ed25519.pub in Notepad and copy the single line. Copy only the .pub file. Never share the private key (the file without .pub).

2. On the server, logged in as root, create the folder and file, then paste the key on one line:

mkdir -p /home/ahmed/.ssh
nano /home/ahmed/.ssh/authorized_keys

3. Fix ownership and permissions. This step is easy to miss when you work as root:

chown -R ahmed:ahmed /home/ahmed/.ssh
chmod 700 /home/ahmed/.ssh
chmod 600 /home/ahmed/.ssh/authorized_keys

4. On AlmaLinux, also reset the SELinux labels:

restorecon -Rv /home/ahmed/.ssh

Why does this matter? By default, OpenSSH ignores a key if the .ssh folder or authorized_keys file is owned by the wrong user or is writable by others. You then get "Permission denied (publickey)" even though the key is correct. A key broken across two lines fails the same way.

Still failing? Check the SSH log on the server: sudo journalctl -u ssh -n 20 on Ubuntu or sudo journalctl -u sshd -n 20 on AlmaLinux. It usually names the exact problem. Now open a new terminal and test: ssh ahmed@203.0.113.10. It should log you in without the account password.

How do I disable root login and password login over SSH?

Short answer: set PermitRootLogin no and PasswordAuthentication no in the SSH config, then restart SSH.

Only do this after key login works for your new user. Create a small override file:

sudo nano /etc/ssh/sshd_config.d/00-hardening.conf

Add these two lines:

Permit RootLogin no
Password Authentication no

Why the 00- name? OpenSSH uses the first value it reads, and files in that folder load in alphabetical order. Some cloud images add a file like 50-cloud-init.conf that turns password login back on. A 00- file loads first, so your setting wins.

Check the syntax, then restart:

sudo sshd -t
sudo systemctl restart ssh    # Ubuntu
sudo systemctl restart sshd   # AlmaLinux

Keep your current session open. Test a fresh login in a second window. If it fails, fix the file from the session that is still open.

How do I set up a firewall on a VPS?

Short answer: allow SSH first, then switch the firewall on. Use UFW on Ubuntu and firewalld on AlmaLinux. A firewall blocks every port you have not opened on purpose. Fewer open ports means fewer things for bots to poke at.

Ubuntu (UFW):

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

AlmaLinux (firewalld):

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Only open ports 80 and 443 if you will run a website. Skip them for a VPN or database-only server.

How do I change the SSH port safely?

Short answer: open the new port everywhere first, run SSH on both ports while you test, and close port 22 only after a new login works.

Changing the port is optional. It cuts log noise from bots, but it is not real security on its own. Keys and a firewall do the heavy lifting. If you still want to move it, follow this order. We use port 2222 as an example.

1. Open the new port in the server firewall.

sudo ufw allow 2222/tcp                                   # Ubuntu
sudo firewall-cmd --permanent --add-port=2222/tcp         # AlmaLinux
sudo firewall-cmd --reload                                # AlmaLinux

2. Open it in the provider firewall too. Some hosts add a network firewall or "security group" in the control panel, in front of your server. If yours has one, allow port 2222 there as well. Otherwise the connection is blocked before it reaches your VPS. 

3. Allow the port in SELinux (AlmaLinux only). If semanage is missing, install policycoreutils-python-utils first.

sudo semanage port -a -t ssh_port_t -p tcp 2222

4. Listen on both ports for now. Add two lines to /etc/ssh/sshd_config.d/00-hardening.conf. Keeping port 22 open during the test is your safety net.

Port 22
Port 2222

5. Check and restart SSH. Run sudo sshd -t first. On AlmaLinux, run sudo systemctl restart sshd. On Ubuntu, check systemctl is-active ssh.socket. If it says "active", run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket. Otherwise run sudo systemctl restart ssh. (Verify on your exact image; socket handling has changed across recent Ubuntu releases.)

6. Test in a new window. Do not close your current session. On your PC, run ssh -p 2222 ahmed@203.0.113.10. In PuTTY, change the Port box to 2222. On the server, sudo ss -tlnp | grep ssh should show both ports.

7. Only after the test works, close port 22. Remove the Port 22 line, restart SSH again, and test once more. Then close the old port in the server firewall (sudo ufw delete allow OpenSSH on Ubuntu, or sudo firewall-cmd --permanent --remove-service=ssh and sudo firewall-cmd --reload on AlmaLinux) and in the provider firewall.

If the new port fails at step 6, nothing is lost. You are still logged in, and port 22 still works. Fix the firewall or config, then try again.

Should I add swap to my VPS?

Short answer: usually yes on small plans. Swap is backup memory on disk that can stop crashes when RAM fills up.

It is slower than real RAM, so treat it as a safety net, not extra memory. A common starting point is 1–2 GB on a server with 1–4 GB of RAM. That is a rule of thumb, not an official figure.

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Check it with free -h. These commands work on Ubuntu's ext4 and AlmaLinux's default XFS. Btrfs needs extra steps.

How do I set the timezone and hostname?

Short answer: use timedatectl for time and hostnamectl for the server name.

Correct time keeps logs, cron jobs and SSL renewals in order. Both systems sync the clock on their own through systemd, so you mainly set the timezone. The commands are the same on both:

sudo timedatectl set-timezone Asia/Dhaka
sudo hostnamectl set-hostname web1.example.com
timedatectl

Use timedatectl list-timezones to find your city. Many admins keep servers on UTC instead. That makes logs easier to compare across regions.

How do I turn on automatic security updates?

Short answer: use unattended-upgrades on Ubuntu and dnf-automatic on AlmaLinux.

Ubuntu: the package is usually installed on server images. To confirm and enable it:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

AlmaLinux:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

Then edit /etc/dnf/automatic.conf and set apply_updates = yes. Without that line, it only downloads updates. Want an extra guard? Fail2ban bans IPs after repeated failed logins. Ubuntu has it in the main repos. On AlmaLinux, install the EPEL repository first.

Ubuntu VPS setup vs AlmaLinux VPS setup: what changes?

Short answer: for an initial server setup on Ubuntu or AlmaLinux, the steps are the same. Only the package manager, admin group, firewall tool and SSH service name differ.

One small Ubuntu 26.04 change: it ships sudo-rs, a Rust rewrite of sudo. You still type sudo the same way.

Know Which Virtualization Should You Pick? KVM vs OpenVZ VPS

How do I check that my VPS setup worked?

Short answer: try to log in as root (it should fail), list open ports, and read the SSH log.

Five minutes of checks now can save a long night later. Run these from your new sudo user:

1. Root login is blocked. From your own computer, run ssh root@203.0.113.10. You should see "Permission denied".

2. The firewall is on. Run sudo ufw status verbose on Ubuntu or sudo firewall-cmd --list-all on AlmaLinux.

3. Only expected ports are open. Run sudo ss -tulpn. If you see a port you did not plan for, find out what uses it.

4. Bots are being turned away. Run sudo journalctl -u ssh --since today on Ubuntu (use sshd on AlmaLinux). Failed logins from strange IPs are normal. Successful ones you do not recognize are not.

5. Everything survives a reboot. Run sudo reboot, wait a minute, and log in again.

All good? Take a snapshot or backup in your client area now. You will have a clean, secure starting point to roll back to.

What are the most common VPS setup mistakes?

Short answer: locking yourself out, skipping updates, and leaving password login on.

• Enabling the firewall before allowing SSH

• Turning off password login before testing the key

• Closing the only open session after editing SSH settings

• Running websites and apps as root

• Skipping backups. Snapshot the server once it is set up.

Got locked out anyway? Most VPS providers offer a web console (VNC) or rescue mode in the client area, so you can log in without SSH and fix the problem.

How fast do bots attack a new VPS? Real honeypot data

Short answer: often within minutes. In a 2019 Sophos study, one fresh cloud server got its first SSH login attempt in under a minute.

You might assume nobody knows your new server exists yet. Automated scanners sweep the whole IPv4 address range around the clock, though, so a fresh IP gets noticed quickly.

Case study: Sophos cloud honeypots (2019)

Security firm Sophos placed SSH honeypots in 10 popular AWS data centers for 30 days, from 17 January to 15 February 2019. Researcher Matt Boddy published the results in Exposed: Cyberattacks on Cloud Honeypots. What they found:

• First attack: one honeypot was hit in less than a minute. The slowest took close to two hours.

• Steady pressure: each honeypot averaged about 13 login attempts per minute, or roughly 757 per hour.

• Asia was not quieter: the Mumbai honeypot logged 678,013 attempts and Singapore 312,928 in 30 days.

• Root is the main target: "root" made up 5,211,644 of 5,447,956 username attempts, just under 96%.

The report's own advice matches this checklist: use key-based SSH login instead of passwords, and use fail2ban to limit repeated attempts. As the report puts it, "It is not a case of if you will be targeted, but rather when."

What this means for your VPS

Each step in the checklist answers one of these attack habits:

• Bots try root with weak passwords, so you disable root login.

• Bots guess passwords, so you switch to SSH keys.

• Bots scan every open port, so the firewall closes what you do not use.

• Bots exploit old software, so you update first and patch automatically.

The Sophos data is from 2019, and attack volumes change over time. Treat the exact figures as a snapshot, not today's numbers. The practical point is simple: lock the server down before you install anything else.

From the UmmahHost support desk

Need a server to run this checklist on? UmmahHost's Global VPS and BDIX VPS plans come with full root access, so you can follow this guide from minute one.