First steps on your VPS

A new server on the internet is found and probed by automated scanners within minutes. Do these steps on the day your VPS is handed over, in this order. Every command is for Ubuntu 24.04 LTS and is run as root.

In the examples the server's address is 203.0.113.10 and the domain is example.in. Replace them with your server's IP address from the panel and your own domain.

Before you start#

• Your VPS shows as ready under Servers in the panel, and you have revealed and saved the initial root password. See Order a VPS.
• You have a terminal: PowerShell on Windows 10 or 11, or Terminal on macOS and Linux. All of them include the ssh command.
• Check your Ubuntu version after signing in with lsb_release -a. If it is not 24.04, most steps are the same, but package names (for example the PHP version) can differ.

Sign in for the first time#

1. Open your terminal and connect as root. Servers in the panel shows the exact SSH command for your server; if it lists a port other than 22, add -p and the port, for example ssh -p 2200 root@203.0.113.10.

ssh root@203.0.113.10

2. Check the fingerprint. The first time, SSH asks "Are you sure you want to continue connecting?". Type yes and press Enter.
3. Enter the initial root password you revealed in the panel. Nothing appears on screen while you type; that is normal.
4. Update everything before you do anything else:

apt update && apt full-upgrade -y

5. Reboot if asked. If the file /var/run/reboot-required exists, run reboot, wait a minute, and sign in again.

Change the root password#

The initial password was set by us when we built the server, so replace it with one only you know.

1. Run passwd and type a new long password twice:

passwd

2. Store it in a password manager. You will rarely need it once you use an SSH key, but you need it for the provider's console if SSH ever breaks.

Add an SSH key#

A key is much harder to guess or steal than a password. If you do not have one yet, create it on your own computer (not on the server) as in Sign in with an SSH key:

ssh-keygen -t ed25519 -C "asha@laptop"

Then copy the public key to the server.

1. On macOS or Linux, run this on your computer:

ssh-copy-id root@203.0.113.10

2. On Windows, run this in PowerShell on your computer. It appends your public key to the server's list of allowed keys:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Test it in a new window. Open a second terminal and run ssh root@203.0.113.10. It should sign you in without asking for the root password (it may ask for your key's passphrase). Do not go on until this works.

Turn off password sign-in#

Once your key works, stop the server accepting passwords at all. Files in /etc/ssh/sshd_config.d/ are read in name order and the first value wins, so a file starting with 00- takes priority over the others.

1. Create the settings file:

cat > /etc/ssh/sshd_config.d/00-keys-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF

2. Check the configuration for mistakes. No output means it is fine:

sshd -t

3. Restart SSH. Your open session stays connected:

systemctl restart ssh

4. Confirm the settings are live:

sshd -T | grep -E '^(passwordauthentication|permitrootlogin)'

It should print passwordauthentication no and permitrootlogin without-password.

5. Test from a new window. Your key still signs you in. To prove passwords are refused, run this on your computer; it should end with Permission denied (publickey):

ssh -o PubkeyAuthentication=no root@203.0.113.10

Turn on the firewall#

Ubuntu's ufw firewall blocks everything you have not allowed. Allow SSH before you switch it on, or you will lock yourself out.

1. Install it (it is usually there already) and allow SSH:

apt install -y ufw
ufw allow OpenSSH

2. Allow web traffic if you will run a website:

ufw allow 80/tcp
ufw allow 443/tcp

3. Switch it on and type y when asked:

ufw enable

4. Check the rules:

ufw status verbose

Open other ports only when a program needs them, for example ufw allow 8080/tcp, and remove them with ufw delete allow 8080/tcp.

Turn on automatic security updates#

1. Install unattended upgrades and switch it on (choose Yes on the screen that appears):

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

2. Check it is on. Both lines in this file should end in "1";:

cat /etc/apt/apt.conf.d/20auto-upgrades

3. Set the clock to Indian time (optional), so logs and timers read in IST:

timedatectl set-timezone Asia/Kolkata

Security updates now install every day. Some, such as kernel updates, only take effect after a reboot: sign in now and then, and run reboot when /var/run/reboot-required exists.

Install a web stack#

This installs Nginx, PHP and MariaDB, enough for WordPress or most PHP sites.

1. Point your domain at the server. At your domain's DNS provider, set an A record for example.in and for www.example.in to your server's IP address. See Connect your domain for where to find these settings.
2. Install the packages:

apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-xml php-mbstring php-zip php-gd php-intl

3. Secure MariaDB. Answer the questions; removing the anonymous users and the test database is recommended:

mariadb-secure-installation

4. Create the site folder with a test page:

mkdir -p /var/www/example.in
echo '<?php echo "It works on PHP " . PHP_VERSION;' > /var/www/example.in/index.php
chown -R www-data:www-data /var/www/example.in

5. Find your PHP version, which is part of the socket name used in the next step. On Ubuntu 24.04 it is php8.3-fpm.sock:

ls /run/php/

6. Add the site to Nginx. Create /etc/nginx/sites-available/example.in with this content (use nano /etc/nginx/sites-available/example.in):

server {
    listen 80;
    server_name example.in www.example.in;
    root /var/www/example.in;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }
}

7. Switch the site on and reload Nginx:

ln -s /etc/nginx/sites-available/example.in /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

8. Get a free HTTPS certificate from Let's Encrypt once the DNS records point at the server. Certbot asks for an email address and sets up renewal for you:

apt install -y certbot python3-certbot-nginx
certbot --nginx -d example.in -d www.example.in

9. Open the site. https://example.in should show "It works on PHP 8.3". Delete the test page when you upload your real site.

To create a database for your site, open mariadb as root and run these lines with your own names and a long random password:

CREATE DATABASE shop;
CREATE USER 'shop'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT ALL PRIVILEGES ON shop.* TO 'shop'@'localhost';

Keep your own backups#

The provider snapshot for your plan copies the whole disk every 2 or 4 weeks. It is a safety net, not a backup plan. Copy important files and database dumps off the server regularly, for example with mariadb-dump shop > shop.sql and then scp or rsync to another machine.

Troubleshooting#

• Connection timed out. Check the IP address. If you just enabled ufw, make sure OpenSSH is allowed; if you are locked out, write to support@finitehost.com.
• Permission denied (publickey) with your key. The key was not copied, or SSH is offering a different key. Run ssh -v root@203.0.113.10 and look for "Offering public key"; use ssh -i ~/.ssh/id_ed25519 root@203.0.113.10 to pick the key.
• REMOTE HOST IDENTIFICATION HAS CHANGED. Expected only if the server was rebuilt. Remove the old entry with ssh-keygen -R 203.0.113.10 and connect again. If nothing was rebuilt, stop and ask us.
• Certbot fails. The A records must point at this server and port 80 must be open (ufw status). DNS changes can take a while; try again later.
• 502 Bad Gateway from Nginx. The PHP socket name in your site file does not match the one in /run/php/.

What's next#

• VPS renewals and cancellation
• Sign in with an SSH key
• Order a VPS