Set up a new VPS: the essential secure steps

When you first get a VPS, do three things before anything else: create a normal user with sudo (stop using root), switch from password to SSH-key login, and turn on a firewall. This guide walks each step with copy-paste commands.

Throughout, replace <username> with the user you want and <server-ip> with your VPS IP. The example IPs (203.0.113.x) are placeholders.

Create a sudo user

Log in as root first (with the password your provider sent):

ssh root@<server-ip>

Update packages, create the new user, and add it to the sudo group:

apt update && apt upgrade -y
adduser <username>
usermod -aG sudo <username>

Log out, log back in as the new user, and confirm sudo works:

ssh <username>@<server-ip>
sudo -v

No error means you're good. Create the SSH key folder for this user:

mkdir ~/.ssh && chmod 700 ~/.ssh

Log in with an SSH key

Generate the key on your local machine (not on the VPS).

If this is your first VPS:

ssh-keygen -t ed25519 -C "[email protected]"

If you already have another key, name this one (example VPS "vps2"):

# Windows (PowerShell)
ssh-keygen -t ed25519 -C "[email protected]" -f $env:USERPROFILE\.ssh\id_ed25519_vps2

# macOS / Linux
ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519_vps2

Push the public key to the VPS (use the right .pub name if you renamed it):

# Windows (PowerShell)
scp $env:USERPROFILE/.ssh/id_ed25519.pub <username>@<server-ip>:~/.ssh/authorized_keys

# macOS
scp ~/.ssh/id_ed25519.pub <username>@<server-ip>:~/.ssh/authorized_keys

# Linux
ssh-copy-id <username>@<server-ip>

If the key isn't the default name, SSH won't pick it up automatically. Add it to ~/.ssh/config (on Windows that's C:\Users\<username>\.ssh\config, with no .txt extension):

# VPS using the default key
Host vps1
    HostName <server-ip-1>
    User <username>
    IdentityFile ~/.ssh/id_ed25519

# VPS using a named key
Host vps2
    HostName <server-ip-2>
    User <username>
    IdentityFile ~/.ssh/id_ed25519_vps2

Now just ssh vps1 or ssh vps2 - no need to remember IPs or key paths.

Harden SSH

Open the sshd config:

sudo nano /etc/ssh/sshd_config

Set these three lines to disable IPv6 (one less attack surface), disable password login, and disable root login:

AddressFamily inet
PasswordAuthentication no
PermitRootLogin no

If an included .conf file exists, empty it so it can't override your settings:

sudo nano /etc/ssh/sshd_config.d/*.conf

Restart SSH (some distros use sshd instead of ssh):

sudo systemctl restart ssh

Log out and try again: make sure root login and password login are both refused.

Enable the UFW firewall

Install UFW, allow SSH/HTTP/HTTPS, then enable it:

sudo apt install ufw
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable
sudo ufw status

Disable ping (ICMP echo), then reboot

To stop the server answering pings, open the rules file:

sudo nano /etc/ufw/before.rules

Add this line right under the # ok icmp codes for INPUT block:

-A ufw-before-input -p icmp --icmp-type echo-request -j DROP

Finally reboot and log back in once the server is up:

sudo reboot

Troubleshooting