> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hostcloud.in/llms.txt
> Use this file to discover all available pages before exploring further.

# First steps to secure a new VPS

> Protect your new HostCloud Linux VPS with updates, a safer login, a firewall and backups.

A new server is reachable from anywhere on the internet, so it's worth securing it before you put anything important on it. These steps take about 30 minutes and block most common attacks.

> [!NOTE]
>
> HostCloud VPS plans are semi-managed: you're responsible for your server's software, security updates and backups. If you'd rather we do this for you, managed VPS help is available at ₹1,500 + GST per hour. [Open a ticket](/support/open-a-ticket.md) to request it.

> [!WARNING]
>
> Some of these steps change how you log in. Keep your current SSH session open while you make changes, and test the new login in a **second** window before you close the first. If you lock yourself out, click **Console** on the server panel to log in from your browser.

First, [connect to your VPS with SSH](/vps/access-your-vps-over-ssh.md) as `root`. The commands below differ slightly depending on your operating system.

## 1. Install updates

**Ubuntu / Debian**

```bash theme={null}
apt update && apt upgrade -y
```

**AlmaLinux / Fedora**

```bash theme={null}
dnf upgrade -y
```

If the update included a new kernel, restart the server with `reboot`, then log in again.

## 2. Change the root password

Replace the password from your welcome email with a new, long one that you don't use anywhere else:

```bash theme={null}
passwd
```

## 3. Create your own user

Day-to-day work is safer as a normal user that can use `sudo` when needed. Replace `priya` with the username you want.

**Ubuntu / Debian**

```bash theme={null}
adduser priya
usermod -aG sudo priya
```

**AlmaLinux / Fedora**

```bash theme={null}
adduser priya
passwd priya
usermod -aG wheel priya
```

Open a second window and check that you can log in as the new user and run `sudo -i`.

## 4. Use an SSH key instead of a password

An SSH key is much harder to guess than a password. On **your own computer** (not the server), create a key and copy it to the server:

```bash theme={null}
ssh-keygen -t ed25519
ssh-copy-id priya@203.0.113.10
```

Replace `203.0.113.10` with your server's IP address. On Windows, if `ssh-copy-id` isn't available, copy the contents of the `.pub` file into `/home/priya/.ssh/authorized_keys` on the server.

Then check that you can log in with `ssh priya@203.0.113.10` without being asked for the server password.

## 5. Turn off password and root logins

Only do this once your SSH key login works. On the server, edit the SSH settings:

```bash theme={null}
sudo nano /etc/ssh/sshd_config
```

Find these lines (remove any `#` at the start) and set them to:

```bash theme={null}
PermitRootLogin no
PasswordAuthentication no
```

Save the file (**Ctrl+O**, **Enter**, then **Ctrl+X**) and restart SSH:

**Ubuntu / Debian**

```bash theme={null}
sudo systemctl restart ssh
```

**AlmaLinux / Fedora**

```bash theme={null}
sudo systemctl restart sshd
```

Test a new login in a second window before you close your current one.

## 6. Turn on a firewall

A firewall blocks every connection you haven't allowed. Always allow SSH first, or you'll lock yourself out.

**Ubuntu / Debian**

```bash theme={null}
sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
```

**AlmaLinux / Fedora**

```bash theme={null}
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
```

Ports 80 and 443 are for a website. Leave them out if your server doesn't host one. You can also attach a firewall from the **Firewall** tab on the server panel.

## 7. Set up backups

Your VPS isn't backed up unless you set it up. You can:

* Add the **Automated Backup** add-on from your VPS's **Addons** page in the Client Area. Its status and restore points show on the **Backups** tab.
* Take a **snapshot** before big changes, from the **Snapshots** tab with **Create Snapshot**.
* Keep your own copy of important data somewhere other than the server.

![The Backups tab on the VPS server panel, showing that automated backups are enabled, the backup interval and the restore points used](https://mintcdn.com/host-cloud/RZlILv_TrgPxefdL/images/vps/backups-tab.jpg?fit=max\&auto=format\&n=RZlILv_TrgPxefdL\&q=85\&s=a155ce6fea4545de1553a0b42a1d8329)

## Keep it up to date

Repeat step 1 regularly, at least once a month, and whenever you hear about an important security fix.

Still stuck? [Open a ticket](/support/open-a-ticket.md) with your server's IP address.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.