Deploying a brand new Virtual Private Server (VPS) is the first step toward hosting websites, gaming servers, custom APIs, or databases. However, booting up a fresh Linux image leaves the server in a default, unhardened state with direct root access.
This guide provides an end-to-end, production-grade checklist to configure, secure, and optimize a fresh RivinCloud Linux VPS from scratch.
1. Initial Access & System Update
Log into your fresh VPS as root via SSH:
ssh root@your-server-ip
Immediately update all package repositories and upgrade existing packages to the newest patched versions:
apt update && apt upgrade -y
2. Set System Hostname and Timezone
Giving your server a recognizable Fully Qualified Domain Name (FQDN) and synchronizing its clock avoids authentication and log discrepancies.
Set Hostname
hostnamectl set-hostname vps01.yourdomain.com
Set Timezone (e.g. UTC or Asia/Kolkata)
timedatectl set-timezone UTC
# Verify clock synchronization
timedatectl status
3. Create a Sudo User Account
Operating as root invites accidental catastrophic mistakes. Create a dedicated administrative user:
# Create user (replace 'rivinadmin' with your desired username)
adduser rivinadmin
# Add user to the sudoers group
usermod -aG sudo rivinadmin
4. Set Up SSH Key Authentication
Copy your local machine's public SSH key to the new user account:
# On your local computer:
ssh-copy-id -i ~/.ssh/id_ed25519.pub rivinadmin@your-server-ip
Verify you can log in as the new user in a new terminal window:
ssh rivinadmin@your-server-ip
sudo whoami # Should return 'root'
5. Harden OpenSSH Configuration
Now lock down SSH access to prevent unauthorized intrusion:
sudo nano /etc/ssh/sshd_config
Make the following critical changes:
# Disable direct root login
PermitRootLogin no
# Disable password authentication (Keys Only)
PasswordAuthentication no
# Limit authentication attempts
MaxAuthTries 3
# Optional: Change default port
Port 2222
Test the configuration file syntax before restarting:
sudo sshd -t
sudo systemctl restart sshd
6. Configure UFW Firewall
Implement a strict inbound firewall policy:
# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow your SSH port (use 2222 if you changed it)
sudo ufw allow 22/tcp
# Allow standard web ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Enable firewall
sudo ufw enable
7. Create Swap Space (Virtual Memory)
Adding a swap file prevents sudden out-of-memory crashes when applications experience unexpected traffic bursts:
# Allocate a 2GB swap file
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
# Make swap persistent across reboots
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
8. Install Automatic Security Updates & Fail2Ban
Keep critical security patches updated automatically:
sudo apt install unattended-upgrades fail2ban -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
Common Mistakes
- Disabling password authentication before testing SSH keys: Always keep your current SSH session open until you successfully authenticate in a separate terminal.
- Skipping swap configuration: Low-RAM VPS instances will crash abruptly during memory spikes without swap.
Troubleshooting
- Locked out after SSH restart: Access your RivinCloud VPS Web VNC console from your client dashboard to log in locally and inspect
/etc/ssh/sshd_config.
Best Practices
- Periodically reboot your VPS after major kernel upgrades (
sudo reboot). - Back up your configuration files in
/etc/using Git or automated snapshot tools.
Frequently Asked Questions
Why is UTC recommended for server timezones?
UTC ensures consistent timestamps across distributed systems, databases, and multi-region team collaboration without daylight saving shifts.
Conclusion
Your RivinCloud Linux VPS is now securely configured, hardened against brute-force attacks, and ready to host production workloads!