Before You Deploy Anything: My 7 Step VPS Setup Checklist

iamstrangemind

Whenever I spin up a fresh VPS, I try to avoid installing my application immediately. Spending a few extra minutes on the basics usually saves hours of troubleshooting later.

Here's the checklist I follow:

1. Update the system

Always install the latest security patches before doing anything else.

2. Create a non root user

I use a regular user with sudo privileges instead of working as root all the time.

3. Set up SSH keys

SSH key authentication is much safer than relying only on passwords.

4. **Configure a firewall
   **
   Only open the ports that are actually needed (for example SSH, HTTP and HTTPS).

5. Install Fail2Ban

It automatically blocks repeated login attempts and helps reduce brute-force attacks.

6. Enable automatic security updates

Small security updates are easy to forget, so I prefer letting the server handle them automatically.

7. Set up backups and basic monitoring****

A backup you don't have isn't a backup. I also like to monitor CPU, RAM and disk usage from day one.

I'm still learning, so I'm curious:

What is the one thing that's always on your VPS checklist that you think beginners often forget?

Mainfrezzer

Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

iamstrangemind

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

itzsenu

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 0: Verify the VPS isn't oversold or misconfigured. If it is, request a replacement or refund before setting anything up.

@iamstrangemind said:

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

Probably all three.

Mainfrezzer

@iamstrangemind said:

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

Mainly because I don't trust the image. I'm currently a bit occupied and on mobile to find the link but there was just recently a mention of a dedicated server image with pre-embedded authorized key from the provider for quick and easy access to your server.... Screw that 😂

And that nobody just mounts the disk and reads my data

iamstrangemind

@Mainfrezzer said:

@iamstrangemind said:

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

Mainly because I don't trust the image. I'm currently a bit occupied and on mobile to find the link but there was just recently a mention of a dedicated server image with pre-embedded authorized key from the provider for quick and easy access to your server.... Screw that 😂

And that nobody just mounts the disk and reads my data

That's actually a fair point. I'd completely forgotten about providers accidentally shipping images with leftover SSH keys. Encrypting the disk also adds another layer if someone ever gets physical or offline access to the storage. Thanks for bringing that up. 👍

luckypenguin

@iamstrangemind said: Install Fail2Ban

Completely redundant when you setup SSH keys and remap it on a non-standard high port.

Mainfrezzer

@iamstrangemind said:

@Mainfrezzer said:

@iamstrangemind said:

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

Mainly because I don't trust the image. I'm currently a bit occupied and on mobile to find the link but there was just recently a mention of a dedicated server image with pre-embedded authorized key from the provider for quick and easy access to your server.... Screw that 😂

And that nobody just mounts the disk and reads my data

That's actually a fair point. I'd completely forgotten about providers accidentally shipping images with leftover SSH keys. Encrypting the disk also adds another layer if someone ever gets physical or offline access to the storage. Thanks for bringing that up. 👍

https://lowendtalk.com/discussion/218895/interserver-adding-their-own-ssh-key-to-unmanaged-dedicated-servers

There it is.

Also i love setting up tarpits on 22. Theyre on everything i have. There are some instances of insane amounts of time ive wasted for them.

iamstrangemind

@luckypenguin said:

@iamstrangemind said: Install Fail2Ban

Completely redundant when you setup SSH keys and remap it on a non-standard high port.

Fair point. If SSH is key only, the benefit is definitely much smaller. I still install Fail2Ban because I sometimes expose other services (or temporarily enable password auth during testing), so it's a bit of extra defense for very little overhead.

iamstrangemind

@Mainfrezzer said:

@iamstrangemind said:

@Mainfrezzer said:

@iamstrangemind said:

@Mainfrezzer said:
Step 1:

Remove whatever horror template you got and install your own image(by any means necessary )with encryption.

Step 2: boot into it

Step 3: do whatever you want I guess.

That's an interesting workflow. Is the main reason security, avoiding provider customizations, or just wanting a completely reproducible setup?

Mainly because I don't trust the image. I'm currently a bit occupied and on mobile to find the link but there was just recently a mention of a dedicated server image with pre-embedded authorized key from the provider for quick and easy access to your server.... Screw that 😂

And that nobody just mounts the disk and reads my data

That's actually a fair point. I'd completely forgotten about providers accidentally shipping images with leftover SSH keys. Encrypting the disk also adds another layer if someone ever gets physical or offline access to the storage. Thanks for bringing that up. 👍

https://lowendtalk.com/discussion/218895/interserver-adding-their-own-ssh-key-to-unmanaged-dedicated-servers

There it is.

Also i love setting up tarpits on 22. Theyre on everything i have. There are some instances of insane amounts of time ive wasted for them.

I will check it out, Thanks 🙏