The First Ten Minutes on a Fresh VPS — What Actually Matters

Log in and make a real user

SSH in as root the one time, then create a normal account for yourself and give it sudo. Living as root full-time means every typo runs with full privileges, and every service you start inherits that sloppiness.

adduser deploy
usermod -aG sudo deploy

Copy your SSH key to the new user so you can log in as them:

rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy/

Open a second terminal and confirm ssh deploy@your-ip works and sudo whoami prints root before you go any further. Never lock yourself out of a box by editing SSH config in your only session.

Turn off password logins entirely

This is the single highest-value thing on the list. Once your key works, keys become the only way in, and the entire category of password-guessing attacks — which is 99% of the noise in your auth log — simply stops mattering. A brute-force against a 4096-bit key is not happening this side of the heat death of the universe.

Edit /etc/ssh/sshd_config (on newer distros the real setting may live in /etc/ssh/sshd_config.d/):

PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no

Then reload and, again, test from a fresh terminal before closing the one you have:

sudo systemctl reload ssh

If your provider hands you a root password by default, this step is what neuters it.

Put up a firewall

Default-deny inbound, allow the couple of ports you actually use. ufw is the least painful way to do this on Ubuntu/Debian:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable

Add ports as you add services (sudo ufw allow 80,443/tcp when you put up a web server). The point isn't that a firewall stops a determined attacker — a service you deliberately expose is exposed regardless. The point is that it stops you from accidentally exposing the database you bound to 0.0.0.0 at midnight and forgot about. Most real breaches are an accident you made, not an attack you suffered.

Let it patch itself

Unattended security upgrades are boring and they are the reason you don't wake up to a wormed box because you were three weeks behind on an OpenSSL CVE.

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

By default it only applies security updates, which almost never break anything. If you run something fragile, leave automatic reboots off and just reboot on your own schedule when the box tells you a kernel update is pending.

That's the list. Non-root user, key-only SSH, a firewall, auto-patching. If you do nothing else, you've closed the doors that actually get kicked in.

The stuff you can skip (and why)

Now the cargo cult. None of these are wrong, exactly. They're low-value ceremony that people perform because a blog told them to in 2013, and each adds friction or a false sense of safety.

• Changing the SSH port. Moving 22 to 2222 quiets the dumb scanner noise in your logs, and that's the entire benefit. It's not security — a real scan finds your SSH in seconds. You bought tidiness, not protection, and now you've a non-standard port to remember everywhere forever.

• Port knocking. A sequence of "secret" packets to open the port. Clever, fragile, and it breaks the moment you're on a network that mangles the timing. Key-only auth already gives you everything knocking pretends to.

• fail2ban as your main defense. It bans IPs after failed logins — but once password auth is off, there are no meaningful failed logins to ban. On a key-only box it's guarding a door that's already welded shut. Fine for password-protected web apps; redundant for SSH. People install it to feel safe, then skip the actual fix.

Do the few things that remove whole classes of attack, and resist piling on rituals that only generate the feeling of security. A clean box with keys-only SSH and a firewall beats one buried under six half-configured security tools.

Whether the box came from a hyperscaler or somewhere like NoctHost where you sign up with just an email and pay in crypto, this checklist is identical — the provider hands you a clean box, and the first ten minutes are on you.