The First Hour With a New VPS

A new VPS gets scanned within minutes of its first boot — automated bots hammer port 22 looking for weak passwords all day, every day. The first hour is about not being low-hanging fruit.

The checklist, in order

# 1. System update first — the image is weeks stale
sudo apt update && sudo apt -y upgrade

# 2. A non-root user with sudo
adduser deploy && usermod -aG sudo deploy

# 3. SSH keys for that user — passwords off after this
mkdir -p /home/deploy/.ssh
cp ~/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh && chmod 600 /home/deploy/.ssh/authorized_keys

Then sshd_config: PasswordAuthentication no, PermitRootLogin no (or prohibit-password), restart sshd — test a second SSH session before closing the first. The lockout you just avoided is the classic self-hosting rite of passage.

Time and logs matter before services do

timedatectl to UTC — mixed timezones turn every incident into archaeology. journald persists logs by default on modern systemd; a box with non-persistent logs can't tell you what happened last boot.

::lab(first-hour)

Field notes

• Don't disable root until the new user provably sudo works — test, then lock.
• Automatic security updates (unattended-upgrades) on by default; reboots scheduled, not surprised.
• Write down what you did — the README.md for your own server is the most valuable file you'll create.