DEV Community

Sospeter Mong'are
Sospeter Mong'are

Posted on

First 10 Things to Do After Accessing Your New Linux Serve

#linux #contabo #devops

After successfully SSH-ing into your new server (for example 178.18.23.12), here's your step-by-step checklist to properly set it up for production use:

1. Verify Basic System Info 

# Check OS version cat /etc/os-release # Check disk space df -h # Check memory free -h # Check CPU lscpu
Enter fullscreen mode Exit fullscreen mode

Why? Confirm you have the expected resources and OS version.

2. Change Default Passwords IMMEDIATELY 

# Change root password (even if using SSH keys) passwd # If you created a sudo user: passwd yourusername
Enter fullscreen mode Exit fullscreen mode

Pro Tip: Use a 20+ character random password stored in a password manager.

3. Create a New Sudo User (Never Use Root Daily) 

# Create user adduser yourusername # Grant sudo (Debian/Ubuntu) usermod -aG sudo yourusername # Grant sudo (CentOS/RHEL) usermod -aG wheel yourusername
Enter fullscreen mode Exit fullscreen mode

Now log out of root and use this user instead:

exit ssh yourusername@178.18.243.142
Enter fullscreen mode Exit fullscreen mode

4. Set Up SSH Key Authentication

On your local machine (not the server):

ssh-keygen -t ed25519 -a 100 # Creates ~/.ssh/id_ed25519.pub ssh-copy-id yourusername@178.18.243.142
Enter fullscreen mode Exit fullscreen mode

Then disable password logins:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Set:

PasswordAuthentication no PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

Restart SSH:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

5. Enable Automatic Security Updates

Debian/Ubuntu 

sudo apt install unattended-upgrades sudo dpkg-reconfigure unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

CentOS/RHEL 

sudo yum install yum-cron sudo systemctl enable --now yum-cron
Enter fullscreen mode Exit fullscreen mode

6. Configure a Firewall

UFW (Debian/Ubuntu) 

sudo ufw allow 22/tcp # SSH sudo ufw allow 80/tcp # HTTP (if needed) sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

firewalld (CentOS/RHEL) 

sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --reload
Enter fullscreen mode Exit fullscreen mode

7. Install Essential Tools 

# For Debian/Ubuntu sudo apt install -y htop nano git curl fail2ban # For CentOS/RHEL sudo yum install -y htop nano git curl epel-release sudo yum install -y fail2ban
Enter fullscreen mode Exit fullscreen mode

8. Set Up Basic Monitoring

Install and Configure Fail2Ban 

sudo systemctl enable --now fail2ban
Enter fullscreen mode Exit fullscreen mode

Check Logs Regularly 

# Failed SSH attempts sudo grep "Failed" /var/log/auth.log # Debian/Ubuntu sudo grep "Failed" /var/log/secure # CentOS/RHEL # Active connections ss -tulnp
Enter fullscreen mode Exit fullscreen mode

9. Secure Critical Files 

# Make sensitive files immutable sudo chattr +i /etc/passwd /etc/shadow /etc/group /etc/sudoers # Restrict cron access sudo rm /etc/cron.deny # Delete if exists echo "yourusername" | sudo tee /etc/cron.allow
Enter fullscreen mode Exit fullscreen mode

10. What Next? Depends on Your Use Case

For Web Servers: 

sudo apt install nginx # or apache2 sudo ufw allow 80/tcp sudo ufw allow 443/tcp
Enter fullscreen mode Exit fullscreen mode

For Database Servers: 

sudo apt install mysql-server sudo mysql_secure_installation
Enter fullscreen mode Exit fullscreen mode

For Development: 

# Install Docker curl -fsSL https://get.docker.com | sudo sh sudo usermod -aG docker yourusername
Enter fullscreen mode Exit fullscreen mode

Bonus: First Night Checklist

✅ All default passwords changed

✅ Root SSH login disabled

✅ SSH keys configured (password auth disabled)

✅ Firewall active with minimal ports open

✅ Automatic updates enabled

✅ Basic monitoring (Fail2Ban) running

✅ Critical files secured

After this: Proceed with your specific application setup (WordPress, Node.js, game server, etc.).

Emergency Reminder

Always keep a backup SSH session open when making critical changes! If you lock yourself out:

  1. Use your hosting provider's VNC console access
  2. For cloud servers (AWS/Azure/GCP), use their rescue mode

Top comments (0)