Initial VPS Setup on Ubuntu and AlmaLinux in 2026

What you should have before you start

This initial VPS setup guide takes you from a fresh SSH login to a server that is patched, protected, and ready for real hosting work. It covers Ubuntu, Debian, AlmaLinux, and Rocky Linux, so you can follow the right path for your Hostperl VPS without guessing which commands apply.

Use these placeholders as you go: SERVER_IP is your VPS address, DOMAIN_NAME is the hostname you want to use, and ADMIN_USER is the non-root account you will create. Example values might be 203.0.113.10, app1.example.com, and hostadmin. If you are sizing a new server or planning a migration, a Hostperl VPS is the right place to start.

Before you change anything, open a terminal on your local computer and connect as root or your provider’s default admin user.

ssh root@SERVER_IP

If your VPS uses a default non-root account, replace root with that username. Keep this first session open until you have verified the new sudo user.

Check the operating system first

Run this on the VPS as root. It tells you whether to use the Debian family or the RHEL-compatible family.

cat /etc/os-release

You should see either Ubuntu or Debian with apt, or AlmaLinux and Rocky Linux with dnf. The next steps are split accordingly, and you should not mix the commands.

Ubuntu and Debian: create a sudo user, update packages, and set a hostname

Run the following on the VPS as root if ID=ubuntu or ID=debian. Start by creating your admin account, giving it sudo access, and setting a shell password only if you need one for break-glass access.

adduser ADMIN_USER

This creates the account and prompts for a password and basic user details. Next, add the user to the sudo group.

usermod -aG sudo ADMIN_USER

Confirm the group membership.

id ADMIN_USER

Now set the hostname to match your server role. Replace app1.example.com with your real domain or internal hostname.

hostnamectl set-hostname app1.example.com

Verify it immediately.

hostnamectl

Update the package index and install the base tools you will use for the rest of the setup.

apt update
apt -y upgrade
apt -y install sudo curl wget ca-certificates ufw fail2ban chrony vim

When this finishes, Debian and Ubuntu should report no broken packages. Then confirm time sync is active.

systemctl enable --now chrony || systemctl enable --now chrony.service
chronyc tracking

For storage checks, confirm your root disk and free space before you add applications later.

df -hT
lsblk

AlmaLinux and Rocky Linux: create a sudo user, update packages, and set a hostname

Run the following on the VPS as root if ID=almalinux or ID=rocky. Create the admin account and place it in the wheel group for sudo access.

useradd -m -G wheel ADMIN_USER
passwd ADMIN_USER

Check the group assignment before moving on.

id ADMIN_USER

Set the hostname now so logs and prompts stay consistent.

hostnamectl set-hostname app1.example.com
hostnamectl

Update the server, install your base tools, and make sure time sync is enabled.

dnf -y update
dnf -y install sudo curl wget ca-certificates firewalld fail2ban chrony vim
systemctl enable --now chronyd

Verify time sync and disk layout.

chronyc tracking
df -hT
lsblk

Install your SSH key and test the new account

Do not disable root yet. Open a second terminal on your local computer and prepare your SSH key if you already have one. Replace ~/.ssh/id_ed25519.pub with the public key you actually use.

ssh-copy-id -i ~/.ssh/id_ed25519.pub ADMIN_USER@SERVER_IP

If you need to install the key manually, run these commands on the VPS as root. This creates the SSH directory with the right permissions and copies the key safely.

mkdir -p /home/ADMIN_USER/.ssh
chmod 700 /home/ADMIN_USER/.ssh
cat >> /home/ADMIN_USER/.ssh/authorized_keys

Paste the public key, then press Ctrl+D. Finish by setting ownership and permissions.

chown -R ADMIN_USER:ADMIN_USER /home/ADMIN_USER/.ssh
chmod 600 /home/ADMIN_USER/.ssh/authorized_keys

Now test the login from your local computer in the second terminal.

ssh ADMIN_USER@SERVER_IP

After you connect, confirm sudo works before changing any SSH rules.

sudo -v
whoami
pwd

You should see your non-root username, and sudo -v should return without an error.

Harden SSH without locking yourself out

Make the SSH change only after the new account works. On the VPS as root, edit the SSH daemon config and keep a copy of the original file first.

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
nano /etc/ssh/sshd_config

Add or confirm these settings. Adjust only the lines you need; do not paste duplicates if the file already contains them.

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
X11Forwarding no

Save and exit the editor, then test the syntax before reloading SSH.

sshd -t

If there is no output, the syntax is valid. Reload the service now.

systemctl reload ssh || systemctl reload sshd

Keep your old root session open until you have confirmed a fresh SSH login works from the second terminal.

Open the firewall before you close anything else

Allow SSH first, then add web and monitoring ports later as needed. On Ubuntu and Debian, use UFW.

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose

On AlmaLinux and Rocky Linux, use firewalld. This sequence keeps SSH available while you add the new rules.

systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all

If SELinux is enforcing, leave it on. Check the current mode instead of disabling it.

getenforce

For a new VPS, enforcing is normal. If you later install Nginx, Apache, or a panel, you can add the correct SELinux rules instead of weakening the system.

Enable Fail2Ban and basic log review

Fail2Ban helps slow down password sprays and noisy scans. On Ubuntu and Debian, start the service and confirm it is active.

systemctl enable --now fail2ban
systemctl status fail2ban --no-pager

On AlmaLinux and Rocky Linux, the service name is the same.

systemctl enable --now fail2ban
systemctl status fail2ban --no-pager

Check authentication logs after your SSH test so you can see the clean connection and catch mistakes early.

journalctl -u ssh -n 50 --no-pager || journalctl -u sshd -n 50 --no-pager

On RHEL-compatible systems, also check audit logs if you suspect SELinux or permission issues.

ausearch -m AVC,USER_LOGIN -ts recent

Set up swap if your VPS is small

On a lighter VPS, swap gives you some breathing room during updates and package installs. A 1 GB swap file is enough for many small sites and control-panel tasks.

fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' | tee -a /etc/fstab
swapon --show

If fallocate is not available on a given filesystem, use dd instead. The final swapon --show output should list /swapfile.

Quick verification from both sides

From your local computer, confirm that root login is blocked and the new user still works.

ssh root@SERVER_IP
ssh ADMIN_USER@SERVER_IP

The first command should fail if you set PermitRootLogin no. The second should connect with your key. Then test a simple command on the VPS as the non-root user.

sudo -v
systemctl is-active fail2ban
free -h
ip addr show

You should see Fail2Ban active, swap available if you enabled it, and your network address on the correct interface.

Common problems and the fastest fix

• SSH login fails after hardening: Run sshd -t from the root console and review /etc/ssh/sshd_config. If needed, restore the backup with cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config and reload SSH.
• Firewall blocks access: Check ufw status verbose or firewall-cmd --list-all. Re-add OpenSSH or the ssh service before closing the root session.
• Sudo does not work for the new user: Run id ADMIN_USER. On Ubuntu and Debian, add the user to sudo; on AlmaLinux and Rocky Linux, add the user to wheel.
• Time drift shows up in logs: Check chronyc tracking and confirm chrony or chronyd is active.

Why this setup matters before you install anything else

A fresh server only stays manageable if the first hour is disciplined. Once your admin user, SSH keys, firewall, time sync, and swap are in place, you can install Nginx, databases, WordPress, or a control panel without spending the next week recovering from a preventable lockout.

If you plan to move a live site next, review how to move from shared hosting to VPS safely in 2026 and how to set up email, DNS, and SSL on new hosting so the migration does not break mail or certificates.

FAQ

Should I disable root login right away?

No. Verify that the new sudo user works first, then disable root access. Keep the original root session open until you have a successful second login.

Can I use the same steps on Ubuntu and AlmaLinux?

Not for package management or sudo group setup. Use apt and the sudo group on Ubuntu and Debian. Use dnf and the wheel group on AlmaLinux and Rocky Linux.

Do I need swap on every VPS?

Not always. Small VPS plans benefit the most, especially during upgrades or when you install memory-hungry services. Larger plans may not need it.

What should I install next?

For a website, Nginx or Apache is the usual next step. For a CMS, add PHP-FPM and your database. For a managed launch, start with the service that matches your application, not the other way around.