Mission Control · Free tool

Server setup script generator

Secure a new Ubuntu, Debian or AlmaLinux VPS in minutes. Choose your options and get a ready-to-run script that creates a sudo user, hardens SSH, enables the firewall and fail2ban, and more.

1 Your server
2 Admin user and SSH key

Paste the contents of ~/.ssh/id_ed25519.pub. No key yet? Run ssh-keygen -t ed25519 on your computer. Your key stays in this page.

3 SSH hardening
4 Firewall and protection
5 System
6 Optional software
Quick answer

A secure first setup for a new Linux VPS has six steps: update the system, create a non-root sudo user with your SSH key, disable root and password logins over SSH, enable a firewall that allows only the ports you need, install fail2ban against brute-force attacks, and turn on automatic security updates. This generator writes a bash script that does all of it for Ubuntu, Debian and AlmaLinux or Rocky Linux.

Which Linux distribution should I choose for a VPS?

DistributionPackage manager and firewallSupport lifetimeBest for
Ubuntu LTSapt and UFW5 years of standard security updates per releaseBeginners and the widest range of tutorials and software.
Debian stableapt and UFW or nftablesAbout 5 years including long-term supportStability and a minimal base system.
AlmaLinux / Rocky Linuxdnf and firewalld10 years per major releaseRHEL-compatible environments and control panels such as cPanel.

Last updated . Written and reviewed by the AstronautCloud infrastructure team.

Sources and further reading

What the script sets up

A fresh VPS is reachable by everyone on the internet from the first minute. These eight steps are the standard checklist administrators follow on every new Linux server, and the generator writes them for you.

1

Create a sudo user

A named admin account with sudo rights and your SSH key installed, so you stop using root for daily work.

2

Harden SSH

Disable root login and password logins, limit login attempts, drop idle sessions and optionally move the SSH port. The configuration is tested before it is applied.

3

Firewall

UFW on Ubuntu and Debian, firewalld on AlmaLinux and Rocky. Only the ports you choose are open, and SSH is rate limited.

4

Fail2ban

Bans IP addresses that repeatedly fail to log in over SSH, with a ban time and retry limit you choose.

5

Automatic security updates

Installs security patches in the background, with an optional automatic reboot at 04:00 when a kernel update needs it.

6

Swap file

Adds 1, 2 or 4 GB of swap and tunes swappiness so small servers survive memory spikes.

7

Time, hostname and kernel tuning

Correct timezone with time sync, a proper hostname, and safe network sysctl settings against spoofing and SYN floods.

8

Optional software

Common tools, Nginx, Certbot for free SSL certificates, and Docker with the official installer.

How to set up a new VPS

  1. Choose your system and options

    Pick your Linux distribution, the admin username, your SSH public key and the protections you want.

  2. Copy or download the script

    The generator builds a complete bash script and a step-by-step version in your browser. Review it and copy it or download setup.sh.

  3. Log in to the new server and run it

    Connect to your VPS as root with SSH, paste the script into a file, and run it with bash setup.sh.

  4. Test the new login before closing the session

    Open a second terminal and connect as your new user, using your new SSH port if you changed it. Close the original session only when this works.

Initial server setup commands explained

Want to understand what you are about to run? These are the core commands, shown for Ubuntu and Debian.

Create a sudo user

Working as root is risky because one typo can damage the whole system. Create a normal user and give it administrator rights through the sudo group.

adduser deploy
usermod -aG sudo deploy

Disable root login and password logins over SSH

Place your settings in a drop-in file. Naming it 00-hardening.conf makes it load first, so it wins over cloud-image defaults. Test it with sshd -t before restarting.

# /etc/ssh/sshd_config.d/00-hardening.conf
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3

Turn on the UFW firewall

Deny everything coming in, then allow only what you need. Allow SSH before enabling the firewall so you do not cut yourself off. ufw limit slows down brute-force attempts.

ufw default deny incoming
ufw default allow outgoing
ufw limit 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

Block brute-force attacks with fail2ban

Fail2ban watches the SSH log and bans an address after repeated failures.

# /etc/fail2ban/jail.local
[sshd]
enabled  = true
maxretry = 5
bantime  = 1h

Add a swap file

Swap gives a small server breathing room during memory spikes, so the kernel does not kill your application.

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

Server setup FAQ

Is it safe to run a script generated on a website?

Read it first, then run it. This generator builds the script entirely in your browser from your choices. It never downloads anything from our servers, and the commands are standard Linux administration commands that you can read line by line. Never run a script you have not read as root.

Will I get locked out of my server?

The script is ordered to avoid it. It creates your user and installs your SSH key first, tests the SSH configuration with sshd -t before restarting, and only then enables the firewall with your SSH port already allowed. Always keep your current SSH session open and test the new login in a second terminal before you close the first.

Why disable root login and password authentication?

Bots try thousands of root passwords against every public server within minutes of it going online. Logging in as a normal user with an SSH key removes that whole attack: there is no password to guess, and a key cannot be brute-forced. You still get full control through sudo.

What is different on Ubuntu 24.04 and newer?

Recent Ubuntu releases start SSH through systemd socket activation, so changing the Port in sshd_config alone does not move the SSH port. When you pick a custom port the script disables ssh.socket and runs the regular ssh service so the new port really takes effect.

Should I use UFW or firewalld?

Use the default for your distribution. Ubuntu and Debian use UFW, which is simple and works well on a VPS. AlmaLinux and Rocky Linux use firewalld. The generator writes the right commands for whichever system you choose.

Does Docker bypass my firewall?

Yes. Docker adds its own iptables rules, so a published container port can be reachable from the internet even when UFW blocks it. Bind containers to 127.0.0.1 or put a reverse proxy such as Nginx in front, and only publish the ports you really need.

How much swap does a VPS need?

A small VPS with 1 to 2 GB of RAM benefits from 1 to 2 GB of swap so a memory spike does not get a process killed. With 4 GB of RAM or more, 2 GB is plenty. The script also lowers swappiness to 10 so the server only uses swap when it really has to.

More free tools

Need a server to run it on?

AstroPod Cloud VPS: AMD EPYC, NVMe storage, full root access and 10 Gbps networking, from $14.99/mo.

See Cloud VPS