What to do in the first hour

The machine is provisioned and facing the internet from the first minute. Half an hour of setup now saves you from picking through a breach later.

1. Update the system

apt update && apt upgrade -y
reboot

On AlmaLinux and CentOS Stream, use dnf upgrade -y. A reboot is needed if the kernel was updated.

2. Add an SSH key

A password is a temporary way to log in. Generate a key on your side and add it under the “Access” tab, in the “SSH keys” subsection: the list is replaced entirely, so submit the full set. For details, see SSH keys.

Saving keys reboots a running machine: they are applied by the initial setup at boot. In the first hour that costs you nothing, later it means downtime — which is why keys are the second item on the list.

On Windows Server, SSH keys do not work at all: there you log in over RDP with a password, so skip this step and use RDP protection instead.

Make sure key-based login works, and only then disable the password:

nano /etc/ssh/sshd_config

PasswordAuthentication no
PermitRootLogin prohibit-password

systemctl restart ssh

Do not close your current session until you have verified key login from a new window. If you lock yourself out, the text console in the panel will save you.

3. Create a regular user

You should not work as root all the time: one typo in rm costs you the machine.

adduser artem
usermod -aG sudo artem
mkdir -p /home/artem/.ssh
cp /root/.ssh/authorized_keys /home/artem/.ssh/
chown -R artem:artem /home/artem/.ssh
chmod 700 /home/artem/.ssh
chmod 600 /home/artem/.ssh/authorized_keys

On AlmaLinux the group is called wheel, not sudo.

4. Enable the firewall

apt install -y ufw
ufw allow OpenSSH
ufw enable
ufw status

Open ports as needed: ufw allow 80/tcp, ufw allow 443/tcp. Leave everything else closed.

5. Check the time and the machine name

timedatectl set-timezone Europe/Moscow
hostnamectl set-hostname my-vds

Wrong time breaks certificates, logs and the scheduler.

6. Make sure the guest agent is running

The panel needs it to show used space and to perform a soft reboot:

systemctl status qemu-guest-agent

If the service is missing:

apt install -y qemu-guest-agent && systemctl enable --now qemu-guest-agent

7. Set up your own backups

There are no automatic machine backups or snapshots — that is your responsibility. Make it a habit from day one: dump the database, archive the project directories, and send everything offsite rather than leaving it on the same machine.

tar czf /root/backup-$(date +%F).tar.gz /var/www /etc/nginx

You can pull a copy to your own machine with scp or rsync.

Checklist

• System updated
• SSH key added and verified
• Password login disabled
• User with sudo created
• Firewall enabled, extra ports closed
• Time zone and machine name set
• Guest agent running
• First backup made and stored off the machine

Next up — quick start: a website in 15 minutes.