A new VPS can be reached from the whole internet as soon as it starts, and automated bots begin trying to log in within minutes. This checklist covers the basics to do straight away: update the system, lock down SSH, turn on a firewall, block brute-force attacks and keep the server patched. Each step is short, and links to a full guide if you'd like more detail.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10.

Before you start

The checklist

  1. Update the system
  2. Create a user with sudo rights
  3. Set up SSH keys
  4. Turn off password logins, after testing your key
  5. Turn on the firewall
  6. Install Fail2ban
  7. Turn on automatic security updates
  8. Set the hostname and time zone
  9. Set reverse DNS if you'll send email
  10. Add swap on small plans
  11. Set up backups

Step 1: Update the system

Log in as root and install all available updates:

Ubuntu/Debian

apt update && apt upgrade -y

AlmaLinux/Rocky

dnf upgrade -y

If a new kernel was installed, reboot with reboot, wait a minute, then log in again.

Step 2: Create a user with sudo rights

Working as root all the time makes mistakes more costly. Create your own user and give it sudo rights. Replace yourname with the username you want.

Ubuntu/Debian

apt install -y sudo
adduser yourname
usermod -aG sudo yourname

The first line makes sure sudo is installed, which it may not be on Debian. adduser asks you to set a password, then for some optional details, which you can skip by pressing Enter.

AlmaLinux/Rocky

useradd -m yourname
passwd yourname
usermod -aG wheel yourname

Choose a strong password. You'll type it whenever you use sudo, even after SSH password logins are turned off.

Step 3: Set up SSH keys

Follow Set up SSH keys to log in to your VPS securely to create a key on your computer, but when you copy the key to the server, use your new username in place of root. On macOS or Linux, for example:

ssh-copy-id yourname@YOUR_SERVER_IP

Then test it from your computer:

ssh yourname@YOUR_SERVER_IP
sudo whoami

You should log in without your server password, and sudo whoami should show root after you type your user's password. Use this user from now on.

Step 4: Turn off password logins

Only do this once Step 3 works. Keep your current SSH window open while you make the change, and test in a second window before you close it.

Ubuntu, Debian, AlmaLinux 9 and 10, and Rocky Linux 9 and 10:

printf 'PasswordAuthentication no\nKbdInteractiveAuthentication no\nPermitRootLogin prohibit-password\n' | sudo tee /etc/ssh/sshd_config.d/01-disable-passwords.conf

Why a separate file starting with 01? The main SSH settings file, /etc/ssh/sshd_config, reads the files in /etc/ssh/sshd_config.d/ first, in alphabetical order, and SSH uses the first value it finds for each setting. On Ubuntu, cloud-init often creates 50-cloud-init.conf in that folder containing PasswordAuthentication yes. If you only change the main file, that line wins and password logins keep working. A file starting with 01- is read first, so your settings win. AlmaLinux and Rocky may have files such as 01-permitrootlogin.conf in the same folder, and 01-disable-passwords.conf is read before those too.

AlmaLinux 8: this version doesn't read that folder by default. Open the main file with sudo nano /etc/ssh/sshd_config, and change the existing lines to PasswordAuthentication no and PermitRootLogin prohibit-password.

Check for mistakes, and check the settings SSH will actually use:

sudo sshd -t
sudo sshd -T | grep -Ei '^(passwordauthentication|permitrootlogin)'

You should see passwordauthentication no, and permitrootlogin set to without-password or prohibit-password, which mean the same thing. If passwordauthentication still says yes, find the file that sets it with sudo grep -ri passwordauthentication /etc/ssh/sshd_config /etc/ssh/sshd_config.d/.

Restart SSH. The service is called ssh on Ubuntu and Debian, and sshd on AlmaLinux and Rocky:

Ubuntu/Debian

sudo systemctl restart ssh

AlmaLinux/Rocky

sudo systemctl restart sshd

Now test from a second window, leaving the first one open:

ssh yourname@YOUR_SERVER_IP

That should still log you in with your key. To confirm passwords are now refused, try:

ssh -o PubkeyAuthentication=no yourname@YOUR_SERVER_IP

This should fail with "Permission denied (publickey)". If your key login doesn't work, use the first window to delete /etc/ssh/sshd_config.d/01-disable-passwords.conf (or undo your changes on AlmaLinux 8) and restart SSH. If you've already closed it, use Open Console. See Use the web console to access your VPS.

Step 5: Turn on the firewall

Allow SSH first, then turn the firewall on. Full details are in Set up a firewall on your VPS with UFW or firewalld.

Ubuntu/Debian

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

AlmaLinux/Rocky

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --list-all

firewalld allows SSH on port 22 by default. Check that ssh is listed under services. If you've moved SSH to a different port, follow the full firewall guide instead. Then open a new SSH window to check you can still log in. If you host websites, open ports 80 and 443 as described in the firewall guide.

Step 6: Install Fail2ban

Fail2ban blocks IP addresses that keep failing to log in. Full details, including how to make sure it never blocks you, are in Protect SSH from brute-force attacks with Fail2ban.

Ubuntu/Debian

sudo apt install -y fail2ban python3-systemd

AlmaLinux/Rocky

sudo dnf install -y epel-release
sudo dnf install -y fail2ban

Then, on all systems, create a basic settings file and start Fail2ban:

printf '[sshd]\nenabled = true\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

Step 7: Turn on automatic security updates

Ubuntu/Debian

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes when asked.

AlmaLinux/Rocky

sudo dnf install -y dnf-automatic
sudo nano /etc/dnf/automatic.conf

In the [commands] section, set upgrade_type = security, download_updates = yes and apply_updates = yes. Save and exit, then run:

sudo systemctl enable --now dnf-automatic.timer

See Turn on automatic security updates on your VPS for automatic reboots, and how to check it's working.

Step 8: Set the hostname and time zone

Give your server a recognisable name. A full domain name that you control works best, such as server1.example.co.nz:

sudo hostnamectl set-hostname server1.example.co.nz

Add an A record for that name, pointing to your VPS IP address, in your domain's DNS. If sudo then warns that it's "unable to resolve host", add a line such as 127.0.1.1 server1.example.co.nz server1 to /etc/hosts with sudo nano /etc/hosts.

Set the time zone, so logs and scheduled jobs use New Zealand time. Daylight saving is handled automatically:

sudo timedatectl set-timezone Pacific/Auckland
timedatectl

To see other time zones, run timedatectl list-timezones. For example, use Australia/Sydney for Sydney time.

Step 9: Set reverse DNS if you'll send email

If your server will send email, for example from a website contact form or your own mail server, set reverse DNS (a PTR record) for its IP address to your hostname. Many mail providers distrust or reject email from servers without it. In the client area, open your VPS's management page, go to IP Assignments, and click the entry in the RDNS column. Make sure the hostname also has an A record pointing to your VPS IP address. See Manage your VPS from the client area. You'll also want SPF, DKIM and DMARC records for the domain you send from.

Step 10: Add swap on small plans

On START and EMBER plans, a swap file helps stop the server running out of memory during updates, builds and npm install. First check you don't already have swap with swapon --show. If it prints nothing, create a 2 GB swap file:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

See Add swap space to your VPS for sizes, tuning, and what to do if fallocate doesn't work.

Step 11: Set up backups

None of our Cloud VPS plans include backups by default. There are two options, and ideally you'll use both:

  • Backups add-on: add it with Upgrade/Downgrade on your VPS's management page. Once it's added, click Login To Panel on the same page to see and restore your backups.
  • Your own off-server backups: regularly copy your important data, such as website files, database exports and app settings, to somewhere other than your VPS, for example your own computer, another server or cloud storage.

Whichever you use, try restoring something now and then, so you know it works when you need it.

Related guides

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.

Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

Where are your servers located?

We run our VPS platform from two datacentres: Auckland, New Zealand: DataVault, in Grafton...
Cloud VPS Getting Started Guide

Welcome to your Hoopla Hosting Cloud VPS. This page is the best place to start. It explains...
Should I move to a VPS? Web hosting vs Managed cPanel VPS vs Cloud VPS

Most websites run happily on web hosting. But as a site gets busier, or you need software that...
Find your VPS login details and IP address

To connect to your new VPS, you need three things: its IP address, the username, and the...
Manage your VPS from the client area

Every Hoopla Hosting VPS comes with a management page in the client area. From there you can...