Your first hour on a new RackNerd VPS

Part 5 of the buyer's series on getting a good RackNerd deal through the sale season.

You bought a VPS and the welcome email has arrived. This guide takes you through the first hour: logging in, updating, creating your own user, switching to SSH keys and turning on a firewall. At the end you will have a server that is safe to start building on.

The steps assume Ubuntu or Debian, the most common choices for beginners. Other Linux distributions use different commands for packages and the firewall, so follow their own documentation for those steps. A RackNerd VPS is unmanaged, which means these jobs are yours. Support can help with the server itself and the network, but usually not with your software.

What is in this guide

• What unmanaged means
• Before you start
• 1. Read the welcome email
• 2. Log in for the first time
• 3. Update the system
• 4. Create your own user
• 5. Set up SSH keys
• 6. Turn off password and root login
• 7. Turn on the firewall
• 8. Turn on automatic security updates
• 9. Check memory, disk and swap
• 10. Plan your backups
• Troubleshooting
• Limits
• What next
• More in the series

What unmanaged means

With an unmanaged VPS, the provider keeps the hardware, the network and the virtual machine running. Everything inside the server is up to you: the operating system, updates, security, the software you install and your backups.

Usually handled by the provider	Usually handled by you
Hardware and power	Operating system updates
The network to the server	Users, passwords and SSH keys
The control panel for reinstalling or rebooting	Firewall and security settings
Billing and your account	Installing and fixing your apps
	Backups of your data

If you would rather not look after a server at all, shared hosting handles most of this for you. See shared hosting vs reseller.

Before you start

• The welcome email from RackNerd, with the server's IP address and login details.
• A computer with an SSH client. macOS and Linux have one built in, and so does current Windows, through Command Prompt or PowerShell.
• About an hour without interruptions.
• A password manager, or another safe place, to store new passwords.
• A second terminal window. You will keep one session open while testing changes in another.

In the commands below, replace SERVER_IP with your server's IP address and alex with the username you want.

1. Read the welcome email

The welcome email usually includes the server's main IP address, the root password and login details for a VPS control panel. The control panel lets you reboot the server, reinstall the operating system and often reach a console that works even when SSH does not.

Save these details somewhere safe, then delete or archive the email if your mailbox is shared or not well protected. Log in to the control panel once now, so you know it works before you need it in a hurry.

2. Log in for the first time

Open a terminal and connect as root:

ssh root@SERVER_IP

The first time, SSH asks you to confirm the server's fingerprint. Type yes. Then enter the root password from the email.

Change the root password straight away to a long, unique one:

passwd

3. Update the system

A fresh server image may be weeks or months old. Bring it up to date:

apt update && apt upgrade -y

If the update installs a new kernel, reboot when it finishes, then log back in:

reboot

4. Create your own user

Working as root all the time makes mistakes more costly. Create a normal user and give it permission to run admin commands with sudo:

adduser alex
usermod -aG sudo alex

Choose a strong password when asked. Test the new user from a second terminal, leaving the root session open:

ssh alex@SERVER_IP
sudo whoami

If the last command prints root, the user can run admin commands.

5. Set up SSH keys

An SSH key is a pair of files: a private key that stays on your computer and a public key you put on the server. Keys are much harder to guess than passwords. The full walkthrough is in setting up SSH keys on a VPS. The short version, run on your own computer:

ssh-keygen -t ed25519
ssh-copy-id alex@SERVER_IP

Protect the key with a passphrase when ssh-keygen asks. On Windows, if ssh-copy-id is not available, follow the SSH key guide to copy the public key by hand.

Now test it. This should log you in without asking for the server password:

ssh alex@SERVER_IP

Do not move on until key login works.

6. Turn off password and root login

With key login working, stop SSH from accepting passwords and direct root logins. Open the SSH settings file:

sudo nano /etc/ssh/sshd_config

Find these lines, remove any # at the start, and set them like this:

PermitRootLogin no
PasswordAuthentication no

Save and exit (in nano, press Ctrl+O, Enter, then Ctrl+X). Some images also have settings in files inside /etc/ssh/sshd_config.d/ that can override these lines. Check that folder too:

sudo grep -ri "passwordauthentication\|permitrootlogin" /etc/ssh/sshd_config.d/

Check the settings for mistakes, then restart SSH:

sudo sshd -t
sudo systemctl restart ssh

Keep your current session open. In a new terminal, confirm you can still log in as your user with your key. If you cannot, fix it from the open session, or use the control panel console.

7. Turn on the firewall

A firewall blocks every connection you have not allowed. On Ubuntu, and on Debian after installing it, UFW is the simplest one:

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

Always allow SSH before you enable the firewall, or you can lock yourself out. Later, open only the ports your apps need, for example sudo ufw allow 80,443/tcp for a website. Services that only you use, such as dashboards, are safer bound to 127.0.0.1 and reached through an SSH tunnel or a VPN than opened to the internet.

For more hardening ideas, see securing your VPS.

8. Turn on automatic security updates

Security fixes come out all the time. On Ubuntu and Debian, the unattended-upgrades package installs them for you:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes when asked. It handles security updates, but you should still log in now and then to run full updates and reboot when needed.

9. Check memory, disk and swap

See what you have to work with:

free -h
df -h
nproc

free -h shows memory and swap, df -h shows disk space and nproc shows CPU cores. Compare them with the plan you ordered. If something looks wrong, contact RackNerd support.

If the server has no swap, adding a small swap file can stop programs from crashing when memory briefly runs out. Swap is a safety net, not extra RAM: it is far slower than real memory. If you use swap all the time, the plan is too small for the job. The Linux server tools guide covers checking memory use.

10. Plan your backups

Do not assume your plan includes backups. Before you put anything important on the server, decide:

• What to back up. Your app data, databases and config files. The operating system can be reinstalled.
• Where to keep it. Somewhere other than the server itself, such as your own computer or a second server in another location.
• How often. As often as you can afford to lose. Daily is common for websites.
• How to restore. Test a restore once. A backup you have never restored is a guess.

Troubleshooting

Symptom	Likely cause	Fix
Connection timed out	Wrong IP, server still setting up, or the firewall blocks SSH	Check the IP in the email, wait a few minutes, or use the control panel console to run sudo ufw allow OpenSSH
Permission denied (publickey)	Key not on the server, or wrong user	Log in another way (open session or console) and check the key is in ~/.ssh/authorized_keys for that user
Warning that the host key has changed	You reinstalled the server, so it has a new fingerprint	If you did reinstall, remove the old entry with ssh-keygen -R SERVER_IP. If you did not, stop and contact support
Password still accepted after step 6	A file in sshd_config.d overrides your setting	Run the grep command in step 6 and change the matching line
apt says another process is using it	Automatic updates are already running	Wait a few minutes and try again
Locked out completely	SSH or firewall change went wrong	Use the console in the VPS control panel, or reinstall if the server has nothing on it yet

Limits

• This is a starting point. These steps make a new server much safer, but they are not complete security. Each app you install brings its own settings to get right.
• Commands differ by distribution. AlmaLinux, Rocky Linux and others use different package and firewall tools. Follow their own documentation.
• Rules still apply. RackNerd's acceptable use policy covers what you run. Unmetered does not mean unlimited, and fair-use limits apply to bandwidth and CPU.
• Never expose a service without a login. If an app has open sign-up, turn it off after creating your account.

What next

With the basics done, pick your first project:

• Install Docker to run apps in containers: installing Docker.
• Set up a website: WordPress on a VPS or web servers.
• Run your own VPN: setting up a VPN on a VPS.
• Browse ideas: self-hosted apps.

If you find the server is too small for what you want to run, a bigger plan is the simplest fix.

To compare what is available now, start with the cheapest RackNerd VPS guide and check the sales page.

More in the series

This is part 5 of 5. Previous: Choosing a VPS location. Next: back to the start with How to get a RackNerd Black Friday deal. See the whole series.