First steps on your new dedicated server

Your server was installed automatically and its credentials were sent by email. This checklist takes it from the first login to a system that is up to date, reachable with your own user and SSH key, and protected by a basic firewall. It covers Ubuntu, Debian, AlmaLinux and Rocky Linux. If you installed Windows Server, follow the Windows Server guide instead.

Your credentials and first login

The credentials email contains what you need for the first connection:

• The server’s IPv4 address, shown as 203.0.113.10 in this guide. Your routed /64 IPv6 subnet is listed in your dashboard.
• The root password, unless you chose to install your SSH key instead. In that case, log in with the matching private key.
• Out-of-band access is in your dashboard: open the server, then choose Console (IPMI). Keep it in mind, because it works even when SSH does not.

Linux, macOS and current versions of Windows include an OpenSSH client. Open a terminal (PowerShell on Windows) and connect as root:

ssh root@203.0.113.10

On the first connection, SSH shows the server’s host key fingerprint and asks you to confirm it. To be sure nothing sits between you and your server, compare it with the fingerprint printed by this command in the IPMI console, then type yes:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If you logged in with the emailed password, replace it right away, then delete the email:

passwd

The commands in this guide run as root. Once you work as a normal user, prefix them with sudo.

Install updates

The installed image is recent, but security updates are published continuously. Install them before anything else.

Ubuntu and Debian

apt update
apt -y upgrade

AlmaLinux and Rocky Linux

dnf -y upgrade

If a new kernel was installed, reboot so that it takes effect. Your session closes; reconnect when the server is back. Server hardware can take a few minutes to run through its firmware checks.

reboot

For updates from now on, Ubuntu usually has unattended-upgrades enabled for security fixes. On Debian, install it with apt install -y unattended-upgrades and enable it with dpkg-reconfigure -plow unattended-upgrades; on AlmaLinux and Rocky Linux, use dnf-automatic.

Set the hostname and time zone

Give the server a fully qualified name in a domain you control:

hostnamectl set-hostname server.example.com

Make the name resolve locally by adding a line with the public IP to /etc/hosts. On Debian and Ubuntu, replace the 127.0.1.1 line if it still carries the old name:

203.0.113.10   server.example.com   server

At your DNS provider, create a matching A record (and AAAA for IPv6), then set the server’s reverse DNS to the same name. This matters as soon as the server sends email.

UTC is the most practical time zone for servers: logs from different machines line up without conversion. Set it and check that the clock is synchronized:

timedatectl set-timezone UTC
timedatectl

Look for System clock synchronized: yes. If you prefer local time, timedatectl list-timezones lists names such as Europe/Amsterdam.

Create a sudo user and add your SSH key

Working as root all day turns every typo into a system-wide one. Create a personal account, called deploy here, with sudo rights.

Ubuntu and Debian (minimal Debian images may need apt install -y sudo first):

adduser deploy
usermod -aG sudo deploy

AlmaLinux and Rocky Linux

useradd -m -G wheel deploy
passwd deploy

Next, give the account your SSH key. If root already accepts your key, copy its authorized_keys file with the right owner and permissions:

install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/.ssh/authorized_keys /home/deploy/.ssh/authorized_keys

On AlmaLinux and Rocky Linux, also run restorecon -R /home/deploy/.ssh so the SELinux labels are correct. No key yet? Create one and install it with ssh-copy-id, as described in Log in with SSH keys.

Test from a second terminal, leaving the first one open:

ssh deploy@203.0.113.10
sudo whoami

The last command should print root. When key logins work for your user, you can disable password authentication for SSH; the SSH keys guide shows how to do it without locking yourself out.

Turn on a basic firewall

DediJet filters network-level DDoS attacks upstream, before they reach your port. That does not decide which of your services are reachable: a host firewall does. Allow SSH first, then open ports as you add services.

Ubuntu and Debian: ufw

ufw is preinstalled on Ubuntu. On Debian, install it with apt install -y ufw. Then:

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable
ufw status verbose

Answer y when ufw enable warns about existing connections: your session stays open because SSH is allowed. Open more ports the same way, for example ufw allow 80,443/tcp for a web server. The rules apply to IPv4 and IPv6.

AlmaLinux and Rocky Linux: firewalld

dnf install -y firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload
firewall-cmd --list-all

Add services with firewall-cmd --permanent --add-service=https or ports with --add-port=25565/tcp, then run firewall-cmd --reload. If --list-all shows services you don’t use, such as cockpit, remove them with --remove-service.

Check the hardware

Confirm that the server matches your order and that its disks are healthy:

lscpu | grep -E 'Model name|Socket|Core|Thread'
free -h
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT
ip -br address

lscpu shows the CPU model, cores and threads; free -h the memory, slightly below the nominal amount because firmware and kernel reserve some; lsblk the disks and partitions; ip -br address your IPv4 and IPv6 addresses.

On servers with two disks, software RAID 1 is configured by default: both disks hold the same data, so the server keeps running if one of them fails. Check the array:

cat /proc/mdstat

md1 : active raid1 nvme1n1p3[1] nvme0n1p3[0]
      974452736 blocks super 1.2 [2/2] [UU]

md0 : active raid1 nvme1n1p2[1] nvme0n1p2[0]
      1046528 blocks super 1.2 [2/2] [UU]

[2/2] [UU] means both members are present and in sync. Array names, partitions and sizes vary between servers. A resync line with a progress bar means the mirror is still being built in the background; the server is fully usable meanwhile. An underscore in place of a U, as in [U_], means a disk is missing or has failed: read Software RAID and Disk health, then open a ticket.

Next steps

The server is updated, reachable with your own account and behind a firewall: you are cleared for takeoff. From here:

• Switch to SSH keys only and disable password logins.
• Harden the server further before you expose services.
• Check or extend your IPv6 configuration.
• Benchmark the server to keep a baseline for later comparisons.
• Keep the IPMI console and rescue mode guides at hand: they are your way back in when something breaks.

Something does not look right? Our engineers answer tickets 24/7: see Support.