Setting up Ubuntu or Debian on a VPS, the practical way
A real first-setup guide for Debian, Ubuntu and AlmaLinux on a fresh VPS: users, sudo, packages, SSH config, firewall and the small things cloud-init images get wrong.
Cloud images are not bare metal installs, and the gap shows up in the first hour. This guide covers what actually needs doing on a freshly deployed Debian, Ubuntu or AlmaLinux VPS beyond the login prompt — and what you can skip because the image already handles it.
What the image already did for you
Start from what the image gave you rather than reinstalling. The goal is to get from 'image defaults' to 'a server you would defend', not to start over.
- ▹Generated host keys, configured networking, and set the locale.
- ▹Installed cloud-init, which is why there is no manual network configuration to do.
- ▹Deployed a root or default user with an SSH key, depending on the image.
Create a sudo user before you do anything else
Operating as root for everything is convenient and unnecessary. Create a normal user with sudo on day one, install your SSH key for it, and use it going forward.
- 01.adduser yourname — a normal user, no root.
- 02.usermod -aG sudo yourname — grant sudo.
- 03.Copy your authorized_keys into the new user's ~/.ssh/authorized_keys.
- 04.Verify: ssh yourname@YOUR_SERVER_IP, then sudo -v to confirm sudo works.
Update the base system
Cloud images ship months old. Patch before you install anything, or your first packages inherit whatever was vulnerable at build time.
Debian/Ubuntu: apt update && apt full-upgrade -y && apt autoremove -y. AlmaLinux: dnf update -y. If the kernel was updated, reboot now, before configuring services on the old kernel.
Install the basics
- ▹build-essential — compiler toolchain; most source installs need it.
- ▹curl, wget, git, unzip, htop — the tools you will reach for within the hour.
- ▹ca-certificates — without it HTTPS fetches fail in confusing ways.
- ▹rsync — for moving data between servers.
Configure the firewall before adding services
Open SSH, set default-deny incoming, then open ports as you add services — not after. On Debian/Ubuntu that is ufw; on AlmaLinux, firewalld. Our hardening checklist covers the exact order.
Set the hostname, timezone and time sync
A wrong hostname breaks reverse-proxy certificates and makes logs harder to read. Set it deliberately, match it to your DNS, set the timezone, and ensure NTP is running so timestamps are trustworthy.
Turn on automatic security updates
unattended-upgrades on Debian/Ubuntu, dnf-automatic-timers on AlmaLinux. Reboot for kernel updates on a schedule, or let the tool do it — but know which one is happening.
The small things cloud images get wrong
- ▹The default hostname rarely matches your reverse proxy domain.
- ▹Locales are often minimal or unset — fix LANG before anything that cares.
- ▹Some images ship an unnecessary default user; remove it if you created your own.
- ▹NTP is not always started, which makes every log timestamp slightly wrong.
What to do next
Once the base is right, the Caddy reverse proxy guide is the natural next step for anything web-facing, and the SSH hardening guide covers the hardening in depth.
FAQ
QShould I reinstall or use the image as-is?
AUse it as-is and fix what the image gets wrong. Cloud images are fine bases; the defaults just need adjusting to your hostname and firewall.
QDo I need a non-root user if the image gives me root?
AIt is good practice. Root-by-key is acceptable, but a sudo user makes day-to-day work safer and easier to audit.
QWhich OS should I pick?
ADebian for stability and the widest package availability, Ubuntu for the newest software, AlmaLinux for a RHEL-style enterprise base. All three are supported.