The first hour on a new server

You have three priorities in the first hour: finish provisioning, patch the OS, then lock down access without locking yourself out. Do those in that order. After that, set your timezone, turn on automatic updates, and plan reboots.

This picks up from a server you can already reach over SSH.

Before you start

• Provisioning may still be running. Fresh images often use cloud-init to create users and keys. Start by checking it has finished, otherwise your changes can be overwritten mid-boot.
• Keep one SSH session open while you harden logins and the firewall. Use a second session to test. If you cut off both sessions, use the VNC console in Virtualizor from the Hostworld client area to get back in. If you need help, open a support ticket and we will take a look.
• On Ubuntu, enabling ufw before allowing SSH will drop your access because the default is to deny incoming. Always allow SSH first, then enable.
• Do not disable SELinux on AlmaLinux to make a problem go away. It is meant to be Enforcing on RHEL 9 family systems and turning it off weakens the server.

Step 1: Confirm provisioning is finished

This checks cloud-init and waits until it reports completion, so later changes do not get overwritten.

Both AlmaLinux 9 and Ubuntu 24.04

cloud-init status --wait

If you want to see more detail, use the long form:

cloud-init status --long

Step 2: Update the operating system

This refreshes package indexes, then applies all available updates. It gets you current security fixes and, on AlmaLinux, may install a newer kernel that will be used after a reboot.

Ubuntu 24.04

This updates package lists:

sudo apt update

This applies all upgrades, allowing package add or remove where needed:

sudo apt full-upgrade -y

Note for Ubuntu 24.04: the default APT source is now a deb822 file at /etc/apt/sources.list.d/ubuntu.sources. If you are following older guides that only mention /etc/apt/sources.list, check the new location first. To view the default source file:

cat /etc/apt/sources.list.d/ubuntu.sources

AlmaLinux 9

This updates all installed packages to their latest versions:

sudo dnf upgrade -y

Kernel updates install a new kernel. You will need a reboot to start it, which we cover later.

Step 3: Enable automatic security updates

This reduces your patch window by applying updates on a schedule. Plan maintenance windows for restarts where needed.

Ubuntu 24.04

This checks the service that runs unattended upgrades so you know if the mechanism is active:

systemctl status apt-daily-upgrade.service

Unattended upgrades are controlled by files in /etc/apt/apt.conf.d/ and run via the apt-daily and apt-daily-upgrade services. If you have services that must not be restarted automatically on this host, Ubuntu 24.04’s needrestart will now auto-restart affected services during unattended upgrades. To exclude a service, review and set the appropriate options in /etc/needrestart/needrestart.conf as described in the Ubuntu 24.04 release notes.

AlmaLinux 9

This installs the tool that can apply updates automatically:

sudo dnf install -y dnf-automatic

This opens the configuration file so you can set behaviour such as installing updates automatically or only sending notifications. Adjust it to your policy:

sudo nano /etc/dnf/automatic.conf

This enables the timer that automatically installs available updates. Choose the install timer if you want updates applied, not only downloaded:

sudo systemctl enable --now dnf-automatic-install.timer

This verifies the timer is active and when it will next run:

systemctl status dnf-automatic-install.timer
systemctl list-timers 'dnf-*'

Step 4: Create an admin user and grant sudo

This adds a named account for day-to-day administration and gives it sudo rights. Using sudo instead of root gives you an audit trail and reduces risk.

Ubuntu 24.04

This creates a new user and prompts you to set a password and details:

sudo adduser <your-admin-user>

This adds the user to the sudo group, which is authorised by default on Ubuntu:

sudo usermod -aG sudo <your-admin-user>

AlmaLinux 9

This creates a new user with a home directory and Bash shell, then sets a password:

sudo useradd -m -s /bin/bash <your-admin-user>
sudo passwd <your-admin-user>

This adds the user to the wheel group, which is the standard sudo group on RHEL family systems:

sudo usermod -aG wheel <your-admin-user>

Ensure that sudoers grants sudo to the wheel group. This edits the sudoers configuration safely:

sudo visudo

Look for a line like %wheel ALL=(ALL) ALL and make sure it is not commented out.

Step 5: Set up SSH keys for your admin user

This generates an SSH key pair on your workstation and installs the public key on the server account you will use. Key-based login is stronger and lets you disable password authentication later.

Both AlmaLinux 9 and Ubuntu 24.04 (run on your local machine)

This generates a modern Ed25519 SSH key pair and labels it so you can recognise it later:

ssh-keygen -t ed25519 -C "admin key for <host>"

This copies your public key into the server account’s ~/.ssh/authorized_keys so you can log in with the key:

ssh-copy-id <your-admin-user>@<server-ip-or-hostname>

Open a second terminal and test logging in as your admin user with the key. Keep your original root or first session open until you have confirmed the key works.

Step 6: Harden SSH logins safely

This disables direct root SSH access and, once your key works, disables password authentication. Test changes before restarting the SSH service so you do not lock yourself out.

Both AlmaLinux 9 and Ubuntu 24.04

This shows the effective SSH daemon configuration so you can check what a directive is set to:

sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'

Edit the SSH daemon configuration to set the following directives. You can place them in the main file or an appropriate drop-in.

• Set PermitRootLogin no
• After key login is verified, set PasswordAuthentication no

On Ubuntu, there is an Include /etc/ssh/sshd_config.d/*.conf line at the top of /etc/ssh/sshd_config. Drop-ins under /etc/ssh/sshd_config.d/ are included at the start and can override settings. If a change will not stick, review the files in that directory and either adjust the correct drop-in or add your own.

This validates the SSH configuration syntax so you can catch mistakes before applying them:

sudo sshd -t

Open a second SSH session and confirm you can log in with your key as the admin user. When you are confident, restart the SSH service.

Ubuntu 24.04

This restarts the SSH service on Ubuntu:

sudo systemctl restart ssh

AlmaLinux 9

This restarts the SSH service on AlmaLinux:

sudo systemctl restart sshd

If you lose access, use the VNC console in Virtualizor from the Hostworld client area to revert the change. If you get stuck, open a support ticket.

Step 7: Configure a host firewall

This puts a default-deny policy in place and only allows services you intend to expose. Always allow SSH first so you do not drop your current session.

Ubuntu 24.04

This allows SSH by service name so port 22 remains reachable:

sudo ufw allow OpenSSH

This enables ufw with the default policy of deny incoming and allow outgoing:

sudo ufw enable

This shows the current rules so you can verify SSH is allowed:

sudo ufw status verbose

AlmaLinux 9

This shows which firewalld zone is the default, which is the one new interfaces will use:

sudo firewall-cmd --get-default-zone

This allows SSH in the default zone and makes the change persistent, then reloads the firewall:

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload

This lists services allowed in the default zone so you can confirm SSH is present:

sudo firewall-cmd --list-services

RHEL 9 family systems use firewalld with nftables as the backend. Use firewall-cmd to inspect and change configuration.

Step 8: Set the timezone and confirm time sync

This ensures logs and scheduled tasks use the right local time and that the clock is synchronised.

Ubuntu 24.04

This shows the current time settings and NTP sync status:

timedatectl status

This sets the timezone to your region, for example London:

sudo timedatectl set-timezone Europe/London

Ubuntu 24.04 uses systemd-timesyncd by default for NTP. The status output confirms it is active.

AlmaLinux 9

This sets the timezone to your region, for example London:

sudo timedatectl set-timezone Europe/London

This checks that chrony, the NTP service on RHEL 9 family systems, is running:

systemctl status chronyd

Step 9: Keep SELinux Enforcing on AlmaLinux

This confirms SELinux mode. Enforcing is the default and recommended state on RHEL 9 family systems.

AlmaLinux 9

This prints the current SELinux mode:

getenforce

If it is not Enforcing, investigate why before you change it. Do not disable SELinux to work around a configuration or labelling issue.

Step 10: Know when to reboot

This checks for a pending reboot and helps you plan maintenance when updates include kernels or core libraries.

Ubuntu 24.04

This checks the standard flag file that signals a reboot is required:

test -f /var/run/reboot-required && echo "Reboot required" || echo "No reboot required"

AlmaLinux 9

Kernel updates are installed as new packages. A reboot is required to start the new kernel. Plan a reboot after dnf upgrade when the kernel has changed.

Step 11: Optional — add swap if your plan calls for it

Some workloads benefit from a swap file, others prefer none. Follow your application vendor’s guidance. If you do add swap, use the distribution procedure so it is enabled at boot and created on a suitable filesystem.

• AlmaLinux 9: see the RHEL 9 storage documentation for creating a swap file or partition and making it persistent in /etc/fstab.
• Ubuntu 24.04: see the Ubuntu Swap FAQ for creating and enabling a swap file.

Note that creating swap files on special filesystems can require extra steps. Do not paste a generic snippet into production without checking.

Step 12: Move files with care

Modern OpenSSH makes scp use SFTP by default. If you are talking to older scp-only servers, you may need the -O flag or use sftp directly. Keep this in mind when copying data to or from a brand new server.

What next

If you are setting up a new Hostworld VPS, you manage power, reboots and the console in Virtualizor from our client area. If anything in this guide trips you up, please open a support ticket so we can look at your exact image and goal.

For broader VPS topics, browse our VPS guides. If you are still deciding where to host, our UK location runs in Maidenhead with London network branding. See our Linux VPS plans.

The next step in this playbook is to install and harden the services you actually plan to run, for example a web stack or an application runtime, using the firewall rules you created here.