The first 10 minutes on a new VPS

Your VPS just deployed. Before you install anything, spend ten minutes on the basics — they make the server secure, up to date and pleasant to work on. Here's the checklist.

1. Log in and update everything

Connect over SSH, then bring the system fully current. On Ubuntu or Debian:

apt update && apt upgrade -y

On AlmaLinux or Rocky:

dnf upgrade -y

A fresh image can still be weeks behind on security patches, so this comes first.

2. Set the hostname and timezone

Give the box a name and correct clock so logs make sense:

hostnamectl set-hostname myserver
timedatectl set-timezone UTC

Pick your own timezone if you prefer local time.

3. Create a non-root user with sudo

Running as root all day is risky — one typo can wreck the system. Make a normal user who can escalate when needed:

adduser deploy
usermod -aG sudo deploy      # on Ubuntu/Debian
# usermod -aG wheel deploy   # on AlmaLinux/Rocky

4. Set up SSH key login

Passwords can be guessed; keys can't be brute-forced in practice. On your local machine, create a key if you don't have one:

ssh-keygen -t ed25519 -C "you@example.com"

Then copy it to the new user on the server:

ssh-copy-id deploy@YOUR_SERVER_IP

Confirm you can log in as deploy in a new terminal *before* moving on.

5. Harden SSH

Once key login works, disable password and root login. Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

Then reload SSH:

systemctl restart ssh

Keep your current session open until you've verified a fresh login still works.

6. Turn on a firewall

Allow only what you need. With UFW on Ubuntu/Debian:

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Never enable the firewall before allowing SSH, or you'll lock yourself out.

7. Add swap (if you have little RAM)

A small swap file prevents crashes when memory spikes on smaller plans:

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

8. Enable automatic security updates

So critical patches land even when you're not watching. On Ubuntu/Debian:

apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

9. Install a couple of comfort tools

apt install htop curl git ufw fail2ban -y

fail2ban alone will block most of the automated SSH brute-force noise every public server sees.

You're ready

In ten minutes you've gone from a raw image to a patched, firewalled server with a proper user, key-only SSH and automatic updates. On Nxeon, one-click OS images and full root make each of these steps quick — and if you'd rather skip the manual work entirely, a one-click control panel can handle users, sites and TLS for you. Either way, do these basics first and everything you build afterward sits on solid ground.