First steps after deployment

Your server is online and you have a root password or an SSH key in your inbox. Before you install anything, spend ten minutes on the following. Every item here prevents a class of problem we see in support tickets weekly.

1. Connect and verify you are where you think you are

ssh root@YOUR_IPV4

# Confirm the machine matches what you ordered
nproc                    # vCPU count
free -h                  # memory
lsblk                    # disks
ip -brief addr           # IPv4 and IPv6 assignments

If any of these disagree with your order, open a ticket before you configure anything. Fixing a mis-provisioned instance is trivial on day zero and disruptive on day thirty.

2. Update the system

# Debian / Ubuntu
apt update && apt -y full-upgrade && apt -y autoremove

# AlmaLinux / Rocky
dnf -y upgrade

# Alpine
apk update && apk upgrade

Templates are rebuilt monthly, so a fresh instance is rarely more than a few weeks behind. It is never zero.

3. Create a non-root user

adduser --gecos "" deploy
usermod -aG sudo deploy        # Debian/Ubuntu
# usermod -aG wheel deploy     # Alma/Rocky

mkdir -p /home/deploy/.ssh
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Open a second terminal and confirm ssh deploy@YOUR_IP works before you touch sshd. Locking yourself out is recoverable through the KVM console, but it is a tedious way to spend an evening.

4. Disable password authentication

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sshd -t && systemctl reload sshd

sshd -t validates the config before reload. Never skip it. If you supplied an SSH key at checkout this is already done for you.

5. Turn on the firewall

# Debian / Ubuntu
apt -y install ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw --force enable

# AlmaLinux / Rocky
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

Deny by default, then open what you actually need. See firewall basics for the full treatment.

6. Set the hostname and check IPv6

hostnamectl set-hostname node-01.example.com
ping6 -c3 2606:4700:4700::1111

Every NimbusVPS server ships with an IPv6 /64. If IPv6 does not respond, see IPv6 setup.

7. Set reverse DNS

rDNS is configured from the control panel, not from the server. Mail servers in particular will not be trusted without matching forward and reverse records. It takes about a minute and there is no charge.

8. Decide your backup story now

RAID-10 survives a drive failure. It does not survive rm -rf, a bad migration, or ransomware. Either enable the off-site snapshot add-on in the panel, or set up Restic to a storage VPS. Do it before you have data worth losing — the decision is always cheaper made early.

Ten minutes now saves the ticket that starts "I think someone got in". The overwhelming majority of compromised servers we see were running password authentication with no firewall.