First VPS Setup: SSH Connection, Root Password, the First 10 Minutes

You have a new VPS and you have an IP address and a root password. Now what? This guide walks step by step through the first 10–15 minutes — from the first connection to the server, to a secure and ready-to-use system. The examples are for Ubuntu 22.04/24.04; Debian is the same.

1. Connect to the server with SSH

SSH (Secure Shell) lets you manage the server remotely from the command line.

# macOS / Linux / Windows (PowerShell or Terminal)
ssh root@SERVER_IP

On the first connection you are asked to confirm the fingerprint (yes), then you enter the root password. Nothing appears on screen while you type the password — this is normal.

Using an SSH key instead of a password is far more secure. If you have not set one up yet, apply the Connecting with an SSH Key guide before this step.

2. Update the system

apt update && apt upgrade -y

The install image is weeks/months old; the first job is to update all packages. If the kernel was updated, reboot once at the end:

reboot

After rebooting, wait ~30 seconds and connect again with SSH.

3. Create a new user

Doing everything as root is risky. Create a normal user with sudo privileges:

adduser arcnar
usermod -aG sudo arcnar

Set a password; you can leave the other fields blank (Enter). From now on you will connect as this user and use sudo when needed.

Copy your SSH key to the new user

# as root:
rsync --archive --chown=arcnar:arcnar ~/.ssh /home/arcnar

Open a new session and verify:

ssh arcnar@SERVER_IP
sudo whoami   # if it returns "root", sudo works

4. Basic security: firewall and SSH

See the Ubuntu Server Security guide for this whole step. The minimum you must do:

# Firewall (UFW) — allow SSH first, then enable
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

# fail2ban — automatically blocks brute-force attempts
sudo apt install fail2ban -y

Before you enable UFW, you must run allow OpenSSH. Otherwise your own SSH connection is cut and you cannot reach the server (you can recover from the console, but it is a hassle).

Harden SSH

After you are sure your SSH key works, in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

sudo systemctl restart ssh

This completely disables login as root and with a password — making 99% of brute-force attacks pointless.

5. Timezone and hostname

sudo timedatectl set-timezone Europe/Istanbul
sudo hostnamectl set-hostname web01

6. Automatic security updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Critical security patches are now installed automatically.

7. Add swap (if RAM is low)

On servers with 2 GB of RAM or less, a swap file is recommended so processes are not killed when memory fills up:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

What's next?

Web server and database: Installing Nginx + PHP + MySQL (LEMP)
Free SSL: Let's Encrypt Setup
Moving your existing site: Website Migration Guide

At Arcnar: When you start a Compute plan, the IP, root password and console access are ready in the panel. The Ubuntu image comes up to date; still, running apt upgrade first is a good habit.

Frequently asked questions

What should I do first on a new VPS?

In order: connect with SSH, update the system (apt update && apt upgrade), create a new user with sudo privileges, add your SSH key, enable the UFW firewall (allowing SSH first), install fail2ban, and disable root + password login over SSH.

My SSH connection was cut when I enabled UFW, what do I do?

This happens if you forgot to run `ufw allow OpenSSH` before `ufw enable`. Use your provider's web console (VNC/noVNC) to log into the server and run `sudo ufw allow OpenSSH`; access is restored.

Should I connect with the root password or an SSH key?

An SSH key is far more secure and recommended. Make the first connection with the root password the provider gave you, and after adding your key, disable password login completely — this makes almost all brute-force attacks pointless.

Is swap needed on a low-RAM VPS?

It is recommended on servers with 2 GB of RAM or less. It prevents critical processes (database, web server) from being killed by the operating system when memory fills up. A 2 GB swap file is enough in most cases.