The First Hour on a New Cloud Server

Before you create the server

1. Generate an SSH key pair locally if you do not already have one: ssh-keygen -t ed25519. Ed25519 keys are short, fast and secure.
2. Add the public key to the provider console before creating the instance, so it is injected at build time.
3. Choose the region deliberately — see choosing a cloud region.
4. Pick a current long-term-support distribution unless you have a reason not to.

Creating the server with a key already attached means you never have a password-authenticated window at all.

First login

1. Connect as root with the key. Confirm key authentication works before changing anything.
2. Update the system: apt update && apt upgrade -y or dnf upgrade -y.
3. Set the hostname and timezone so logs are readable later.
4. Create a non-root user and add it to the sudo or wheel group.
5. Copy the SSH key to the new user with ssh-copy-id or by copying authorized_keys.
6. Open a second terminal and confirm you can log in as the new user and use sudo. Do not close the first session until this works.

That last point has saved more people than any other item on this list. Verify the new access path before removing the old one.

Harden SSH

Edit /etc/ssh/sshd_config (or a file in sshd_config.d) and set:

• PermitRootLogin no — root is the account every scanner tries first.
• PasswordAuthentication no — the single highest-value change. Brute force stops mattering.
• PubkeyAuthentication yes.
• Optionally AllowUsers yourname to restrict who may connect at all.

Reload with systemctl reload sshd and test in a new session before disconnecting. Changing the port is often suggested; it reduces log noise but adds little real security. Disabling password authentication is what matters.

Firewall at two levels

Use the provider’s cloud firewall — Hetzner Firewalls, DigitalOcean Cloud Firewalls, Linode Cloud Firewall, AWS security groups. These filter before traffic reaches the machine, so a misconfigured host firewall cannot expose you.

Then configure the host firewall as a second layer with ufw or firewalld:

1. Default deny inbound, allow outbound.
2. Allow SSH from your address if it is static, or from anywhere if it is not.
3. Allow only the ports the service actually needs — 80 and 443 for a web server.
4. Do not expose databases publicly. Bind them to localhost or a private network.

Reduce the noise

• Install fail2ban to ban addresses after repeated failures. Not a substitute for key-only SSH, but it keeps logs readable.
• Enable unattended security upgrades so patches land without you remembering.
• Set up log rotation if the application writes its own logs.
• Add swap if the instance has little RAM — it prevents the kernel killing processes under momentary pressure.

Before you call it done

Common questions

Where to go next

Follow with Linux server hardening basics and set up backups properly with a backup strategy that survives a bad day.