First steps on a new server

These steps suit Debian and Ubuntu servers. On other systems the commands differ, but the order stays the same. We send you the server’s IP address and login by mail. Do these steps right after your first login, and keep one terminal window open until you have tested every change.

1. Update the packages

apt update
apt upgrade -y

If the update installed a new kernel, restart once with reboot and log in again.

2. Create a normal user with sudo

Daily work as root is risky: one wrong command can damage the whole system. Create your own user:

adduser deploy
usermod -aG sudo deploy

Choose any user name instead of deploy. Now copy your SSH key to the new user:

mkdir -p /home/deploy/.ssh
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Open a second terminal and test: ssh deploy@your-server-ip, then run sudo whoami. It must answer root.

3. Turn on a firewall

ufw is a simple firewall. Allow SSH first, or you will lock yourself out:

apt install -y ufw
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status

Open only the ports you really use. Add others later with ufw allow <port>/tcp.

4. Disable password login

Do this only after your key login works for your new user. Edit /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin prohibit-password

Some systems keep extra settings in /etc/ssh/sshd_config.d/. Check there too. Then test the file and reload:

sshd -t
systemctl reload ssh

Keep your old terminal open, and open a new one to confirm you can still log in. If it fails, fix the file in the old window.

5. Keep it updated

Install automatic security updates:

apt install -y unattended-upgrades

What next

• Set up backups. See “Backups for your server”.
• Point your domain to the server. See “Point a domain to your server”.

On a self-managed server all of this is your job. On a managed server we do it for you, and you can mail support@it-labs.in for changes.