Choosing and installing a VPS

Module 1: Your first server · Reading time: 10 minutes

Learning objective: After this lesson you can choose an operating system and installation for your VPS, get the first settings right and find your emergency exits (console, snapshot, reinstall) before you need them.

Key concepts: distribution, LTS, image, cloud-init, root password, SSH key at installation, IPv4 and IPv6, console, rescue or ISO, snapshot, hostname, time zone

Choosing a distribution

Linux is the core (the kernel). What you install is a distribution: the kernel plus all the programs, a package manager and a team that delivers updates. For servers there are two big families:

Choose a version with long-term support. With Ubuntu this is called LTS (long term support): every two years in April an LTS version is released, with five years of standard security updates. Ubuntu 24.04 LTS gets those until May 2029; Ubuntu 26.04 LTS was released in April 2026. Debian releases a new stable version roughly every two years; Debian 13 (trixie) was released on 9 August 2025 and, together with Debian LTS, gets about five years of updates (until June 2030). In lesson 4.3 you will read how to move to a new version later on.

Why not the latest "interim release"? Ubuntu versions without LTS only get nine months of updates. On a server you don't want to have to do a major upgrade every year.

Can't decide between Debian and Ubuntu? Both are fine. Debian is more minimal and changes less per version; Ubuntu has more guides on the internet and somewhat newer software. The commands in this course work on both.

The image and cloud-init

With a VPS you usually don't install from an installation DVD yourself. You choose an image: a ready-made, minimal installation. On first boot a program called cloud-init adapts that installation to your VPS. It:

• sets the hostname and the network;
• grows the disk to the size of your plan;
• sets the root password or your SSH key;
• creates new, unique host keys for SSH (the keys your server uses to identify itself, lesson 1.3);
• writes the fingerprints of those host keys to the console.

That last point is handy: in the console you can later check that you are talking to the real server.

Password or key at installation

During installation the panel usually asks for a root password and, optionally, a public SSH key. Do both:

• You need the password to log in to the console (the console doesn't know about SSH keys). Choose a long, unique password from your password manager.
• You use the key for SSH. That way you never have to log in with a password over the internet, and you can switch off password login straight away in lesson 2.2.

Don't have a key yet? You will create one in lesson 2.1. You can add it later; that's no problem.

Bots on the internet start trying passwords on port 22 within minutes of the first boot. With a short or reused root password, it's not a question of "if" but "when".

Your emergency exits: look them up now

Before you change anything about SSH or the firewall, you need to know how to get back in if you lock yourself out. A VPS panel almost always has three things for this:

1. The console. Your VPS's screen in your browser, as if you were sitting next to the server with a keyboard and monitor. It works even when SSH, the firewall or the network is broken. You log in with a username and password, not with a key.
2. Snapshots. A point-in-time copy of the whole VPS. Take one before every major change; if things go wrong, you restore it. A snapshot is usually stored on the same storage as your VPS, so it is not a backup (lesson 8.1).
3. Rescue or ISO. Booting from a rescue system or installation ISO to repair your disk when the server itself no longer boots. And as a last resort: reinstalling, which wipes everything.

At WebOké you will find these on the VPS screen: Console, the Snapshots tab, the ISO and rDNS tab, and reinstalling under Settings. Other providers work in a similar way, with names such as "VNC console", "rescue mode" or "rebuild".

Do this right now: open the console once and log in. Then you know it works, and you can see where the paste button is (copying and pasting often works differently in a console).

The first settings

Log in (via the console or SSH, lesson 1.3) and see what you have:

root@web1:~# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
...
root@web1:~# hostnamectl
 Static hostname: web1
...
Operating System: Debian GNU/Linux 13 (trixie)
          Kernel: Linux 6.12.0-...

Three things to get right now:

Hostname. Give your server a name you recognise, ideally the full name you will also put in DNS later:

root@web1:~# hostnamectl set-hostname web1.example.com

Time zone and time. Logs are only useful if the time is correct. Servers are often set to UTC; that's fine, as long as you know it. The example below sets Dutch time; choose your own zone instead, for example Europe/London (readers in the Netherlands keep Europe/Amsterdam):

root@web1:~# timedatectl set-timezone Europe/Amsterdam
root@web1:~# timedatectl
...
System clock synchronized: yes
              NTP service: active

If System clock synchronized does not show yes, the clock will start to drift. That causes trouble with certificates and logs.

Updating. An image is often a few weeks old. Update straight away:

root@web1:~# apt update && apt upgrade

In module 4 you will read exactly what these commands do and how to make this happen automatically.

IPv4 and IPv6

Your VPS usually gets an IPv4 address (for example 192.0.2.10) and an IPv6 address or a whole IPv6 block (for example 2001:db8:10::10). Check which addresses your server has:

root@web1:~# ip -brief address
lo     UNKNOWN  127.0.0.1/8 ::1/128
eth0   UP       192.0.2.10/24 2001:db8:10::10/64 fe80::...

Write both down. Forgetting IPv6 is one of the most common mistakes in server administration: a firewall that only protects IPv4 (lesson 5.2), an AAAA record pointing to an address where nothing is listening (lesson 7.1). Addresses starting with fe80: are link-local and only valid within the local network; you don't use them for DNS.

On AlmaLinux and Rocky Linux

Here too there are versions with long-term support (about ten years per major version). You update with dnf upgrade. hostnamectl and timedatectl work the same way. SELinux is enabled by default; in lesson 10.1 you will read why you should leave it on.

Summary

• Choose a distribution with long-term support: Debian stable or Ubuntu LTS (the main track of this course), or AlmaLinux/Rocky Linux.
• An image plus cloud-init gives you a minimal installation with new host keys; the fingerprints are shown in the console.
• At installation, set a strong root password (for the console) and your public SSH key (for SSH).
• Look up the console, snapshots and rescue/ISO before you need them, and test the console once.
• Set the hostname and time zone, check time synchronisation, update, and write down your IPv4 and IPv6 addresses.

Quiz

Exercise

Exercise O1.2: Setting up your server. Install your VPS (or virtual machine), log in once via the console, take a snapshot, set the hostname and time zone, update, and write down the IPv4, IPv6, distribution and version. Tick off the checklist.

Further reading

At WebOké the parts are named as in these articles; other providers work in a similar way.

• Getting started with your VPS
• Attaching your own ISO or reinstalling your VPS
• No access to your VPS anymore: what now?
• Snapshots and backups of your VPS
• Ubuntu, release cycle: https://ubuntu.com/about/release-cycle
• Debian, releases: https://www.debian.org/releases/