How to Set Up a VPS from Scratch — 2025 Guide

To set up a VPS from scratch, you connect via SSH as root, secure the server, create a non-root user, and then install whatever services you need. The whole process takes under 30 minutes if you follow the steps in order.

This guide covers exactly that — from your first SSH connection to a production-ready server, explained clearly and without fluff.

Once your provider provisions the VPS, you receive a public IP and either a root password or an SSH key. Open a terminal and connect:

ssh root@YOUR_SERVER_IP

On Windows, use PowerShell (Windows 10+) or PuTTY. When you see root@hostname:~#, you have full control of the server — proceed carefully.

Step 2 — Update the Operating System

Always update packages first. An outdated system has known vulnerabilities that bots actively exploit within hours of provisioning.

On Ubuntu / Debian:

apt update && apt upgrade -y

On CentOS / AlmaLinux / Rocky Linux:

dnf update -y

If the kernel was updated, reboot:

reboot

Wait a minute, then reconnect via SSH.

Step 3 — Create a Non-Root User with Sudo

Always working as root is risky — a single typo can wipe critical files. Create a dedicated user instead:

adduser deploy
usermod -aG sudo deploy

On RHEL-based distros, use the wheel group:

usermod -aG wheel deploy

Verify it works:

su - deploy
sudo whoami    # should print: root

Step 4 — Set Up SSH Key Authentication and Disable Passwords

Passwords are the preferred attack vector for brute-force bots. SSH keys are cryptographically stronger and practically unbreakable.

Generate a key pair on your local machine

ssh-keygen -t ed25519 -C "my-vps"

Copy the public key to the server:

ssh-copy-id deploy@YOUR_SERVER_IP

Disable password login and root access

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

systemctl restart sshd

Critical: before closing your current session, open a second terminal and confirm you can log in with your key. If something goes wrong, your open session is your safety net.

Step 5 — Configure the Firewall

A firewall limits which ports are reachable from the internet. The golden rule: deny everything by default, allow only what you need.

With UFW (Ubuntu/Debian)

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp      # SSH
ufw allow 80/tcp      # HTTP
ufw allow 443/tcp     # HTTPS
ufw enable
ufw status

With firewalld (CentOS/AlmaLinux)

firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

If you change the SSH port (recommended to reduce bot noise), open the new port before closing port 22.

Step 6 — Additional Security Hardening

With access and the firewall in place, a few quick tweaks make a big difference:

Fail2ban: automatically bans IPs running brute-force attacks. apt install fail2ban — the default config is enough to start.
Timezone: timedatectl set-timezone America/Mexico_City — makes reading logs much easier.
Hostname: hostnamectl set-hostname my-server.
Automatic security updates: on Ubuntu, install unattended-upgrades and enable it.
Swap: if your VPS has less than 2 GB of RAM, add a swap file to prevent OOM kills.

Create swap (optional but recommended for small VPS)

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

Quick Summary: What You Have at the End

Layer	Status
Operating system	Updated
Access	Non-root user + SSH key
Network	Firewall active, minimal ports
Security	Root SSH disabled, Fail2ban running
Stability	Swap (optional), correct timezone

From here, install whatever your project needs: a LAMP stack, Nginx, Node.js, Docker, or anything else. Browse the rest of the tutorials in our VPS servers category for the next steps.

If you'd rather have a pre-configured VPS with expert support, elenlace.com offers managed VPS plans tailored for Latin American projects.

Key Takeaways

Order matters: always update the OS before anything else.
Never work as root day-to-day — create a sudo-enabled user.
Disabling password authentication eliminates 99 % of SSH bot traffic.
A deny-all firewall is safer than one trying to block specific attacks.
Fail2ban and automatic security updates are the minimum viable setup for production.

Ready to install your first stack? Visit elenlace.com to explore managed VPS plans built for teams in Mexico and Latin America.

FAQ

Which Linux distro should I choose for my VPS?

Ubuntu LTS (22.04 or 24.04) is the most popular choice with the largest community and documentation base. CentOS Stream / AlmaLinux is preferred in enterprise environments needing RHEL compatibility. For beginners, Ubuntu LTS is the safest bet.

Can I set up a VPS without Linux experience?

Yes, with the right guide — but you should know basic terminal commands (navigating directories, editing files with nano, restarting services). If you prefer to avoid the command line, a VPS with a cPanel or Plesk panel simplifies management considerably.

How long does the initial VPS setup take?

Following this guide, the full process (SSH, user, firewall, Fail2ban) takes 15–30 minutes. System updates may take a bit longer depending on your provider and the base image used.

How often should I update my VPS?

Enable automatic security updates (unattended-upgrades on Ubuntu) and run full manual updates at least once a month. Always review changelogs before updating critical packages like the kernel on production servers.

Compare providers

Other providers and guides worth comparing: