Initial VPS Setup Checklist - first 30 minutes on a fresh server

As promised on X/Twitter, here I am starting with the first blog post of many covering about how to setup and manage your VPS and we will cover many topics in this series.

Akash Rajpurohit

@akashwhocodes · Follow

Everyone's yelling "just use a VPS bro, it's cheaper than Vercel!" Cool. But if you're gonna self-host on a VPS, you better know what you're signing up for. 👇 Here are 11 things you must understand before you ditch managed services: 1. Firewalls (UFW/iptables) – Default open

7 78

The Problem

Your fresh VPS is getting probed by bots within minutes of going live. SSH brute force attacks started before you even finished reading the welcome email.

This is not the time to sip a coffee and wait, lets set up your VPS with the security best practices so you can actually start focusing on your project.

The Checklist

Step 1: Create User with Sudo Access

Root login is a massive target. Create your user immediately.

# Replace 'youruser' with your actual username
adduser youruser
usermod -aG sudo youruser

Step 2: Setup SSH Keys and Disable Password Auth

Password authentication = guaranteed breach eventually.

# On your local machine - generate key if you don't have one
ssh-keygen -t ed25519 -C "[email protected]"

# Copy your public key to the server (replace youruser and server-ip)
ssh-copy-id youruser@your-server-ip

# Test login with key works BEFORE disabling passwords
ssh youruser@your-server-ip

Now disable password auth:

sudo nano /etc/ssh/sshd_config.d/01-hardening.conf

Add these lines:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes

# random port number, pick your own (good practice but optional)
Port 6203

sudo systemctl reload ssh

💡

Critical

Test SSH login with your key in a new terminal before closing your current session. If it fails, you’ll lock yourself out.

Step 3: Enable Firewall (Allow SSH First!)

Block everything except what you need.

# Allow SSH FIRST with rate limiting (replace 6203 with your own port)
# Rate limiting allows only 6 connections per 30 seconds from same IP
sudo ufw limit 6203/tcp

# Allow HTTPS if you're running web services
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw --force enable

# Check status
sudo ufw status

Step 4: Install Fail2ban for SSH Protection

Automatic IP blocking after failed login attempts.

sudo apt update
sudo apt install fail2ban -y

# Add SSH jail settings
sudo nano /etc/fail2ban/jail.d/01-hardening.conf

Find the [sshd] section and ensure:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 10m
bantime = 10m

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Step 5: Security Updates and Unattended Upgrades

Keep your system patched automatically.

# Update packages
sudo apt update && sudo apt upgrade -y

# Install unattended upgrades
sudo apt install unattended-upgrades -y

# Enable automatic security updates
sudo dpkg-reconfigure -plow unattended-upgrades

Step 6: Verification Commands

Confirm everything worked:

# Check SSH config
sudo sshd -T | grep -E "(port|passwordauthentication|permitrootlogin)"

# Verify SSH key auth is working (should connect without password prompt)
ssh -p 6203 youruser@your-server-ip

# Verify firewall status
sudo ufw status

# Check fail2ban status
sudo fail2ban-client status sshd

# Check system updates
apt list --upgradable

# View recent login attempts
sudo tail /var/log/auth.log

PROMOTED Built & launched by me 🚀

Secure Your Digital Legacy Forever

A secure digital lockbox with a dead man's switch. When you pass away, your loved ones don't get even ONE EXTRA second to access your bank accounts, investments, or precious memories. Eternal Vault ensures your digital legacy doesn't disappear with you.

Don't Let Your Legacy Disappear

What Could Go Wrong

Locked out of SSH? If you disabled password auth too early:

Use your VPS provider’s console/recovery mode
Re-enable PasswordAuthentication yes in /etc/ssh/sshd_config.d/01-hardening.conf
Restart SSH: sudo systemctl restart ssh

Firewall blocked you? From console:

sudo ufw delete allow 6203/tcp
sudo ufw allow from YOUR_IP to any port 6203

Reality Check

This takes 15-30 minutes first time. After a few servers, you’ll do it in under 10 minutes. Your server is now protected against 95% of automated attacks.

Next steps: Set up monitoring, backups, and whatever services you actually need. But now you can sleep knowing script kiddies aren’t getting in through the obvious holes.