First steps on your new VPSFrom the order to a secured system

Published on October 20, 2026

What you get after ordering

As soon as the order has gone through, our system sets up the VPS automatically. After around 120 seconds, you will find everything you need to get started in the web interface:

• The IPv4 address of your server - this is how you reach it from outside.
• The root password for the first login.
• Access to the VNC console. You need it if you ever lock yourself out of SSH - more on that below.
• The option to reinstall the operating system at any time. If you break something, you simply start over; it only takes a few minutes.

This guide assumes Debian or Ubuntu - the most common choices. On CentOS, the package commands are dnf instead of apt; everything else works the same way.

Connect to the server via SSH

You manage the server via SSH, an encrypted terminal connection. Linux, macOS and Windows 10/11 already ship with a suitable client - you do not need any extra software.

Open a terminal or PowerShell and enter:

ssh root@YOUR-SERVER-IP

On the first connection, SSH asks whether the server's fingerprint can be trusted. That is normal - confirm with yes. Then enter the root password from the web interface. Note: while you type the password, the cursor does not move and no asterisks appear. That is intentional - just keep typing and press Enter.

Once you are in, a prompt such as root@vserver:~# greets you. From here on, you are working directly on your server.

If you prefer a graphical interface, you can use PuTTY or WinSCP on Windows; for file transfers, SFTP is a good choice and uses the same credentials.

Step 1: Update the system

The supplied image is up to date at the time it is built, but there may be weeks between building the image and your order. The first command on every new server is therefore always:

apt update && apt upgrade -y

The first part downloads the current package lists, the second installs all available updates. Depending on the age of the image, this takes one to five minutes.

To make sure security updates keep being installed without you having to remember them, the package for unattended upgrades is worth it:

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

The server now fetches security updates automatically. It still does not perform major version upgrades on its own - that deliberately remains your decision.

Step 2: Create your own user

Working as root all the time is an unnecessary risk: a typo in the wrong command can wreck the system, and automated attacks almost always target the user name root first. So create a normal user who gets administrator rights via sudo when needed.

adduser yourname
usermod -aG sudo yourname

The first command asks for a password and a few optional details that you can skip with Enter. The second adds the user to the sudo group.

Important: test the new login before you disable the root login. Open a second terminal window - leave the existing one open - and connect again:

ssh yourname@YOUR-SERVER-IP
sudo whoami

If the server answers the second command with root, everything works. Only then should you move on.

The next sensible step is switching to SSH keys and disabling password login. The guide Secure SSH access explains this in detail.

Step 3: Switch on the firewall

A freshly installed server accepts connections on every port where something is listening. The opposite approach makes more sense: block everything and only open what you really need. On Debian and Ubuntu, ufw is the simplest tool for this.

apt install ufw -y
ufw allow OpenSSH
ufw enable

The order matters here: ufw allow OpenSSH must come before ufw enable. Otherwise the firewall locks you out the very moment you activate it.

You open further services later on as needed, for example for a web server:

ufw allow 80/tcp
ufw allow 443/tcp
ufw status

The last command shows you at any time what is currently open.

Step 4: Set hostname, time zone and locale

Three small things that save trouble later - not least because log files are otherwise written with the wrong times:

hostnamectl set-hostname my-server
timedatectl set-timezone Europe/London
apt install locales -y && dpkg-reconfigure locales

Replace Europe/London with your own time zone - timedatectl list-timezones lists all of them. In the locale dialog, you usually pick en_US.UTF-8 or en_GB.UTF-8. Then check with timedatectl that the time is correct.

If you have locked yourself out

It happens to the best of us: one firewall rule too many, a typo in the SSH configuration - and the connection is refused. That is what the VNC console in the web interface is for. It is, so to speak, connected directly to the server's screen and works independently of SSH, firewall and network configuration.

In the VNC console, you log in with the root password and undo the problematic change, for example:

ufw disable
systemctl restart ssh

If that does not help or the system is more badly damaged, simply reinstall the operating system in the web interface. That takes a few minutes - provided you have a backup. This is why backups should be set up before real data lives on the server.

Where to go from here

You now have a clean, up-to-date system with basic security in place. Depending on your plans, continue like this:

• Secure SSH with keys - the most important next step for any server that is permanently online.
• Set up a web server - nginx or Apache with PHP, MariaDB and a free SSL certificate.
• Install Docker - if you want to run several services cleanly separated.
• Install Nextcloud - your own cloud for files, calendars and contacts.
• Set up backups - before the first important data lands on the server.

Frequently asked questions