---
title: Initial VPS Setup on Debian
description: First steps after provisioning a fresh Debian VPS — system updates, a non-root user with SSH key auth, unattended upgrades, and hardened SSH config.
pubDate: '2026-04-03T12:00:00+02:00'
category: en/on-premises-private-cloud
tags:
  - debian
  - ssh
---

A fresh VPS comes with a root account and not much else. Before installing anything, the server needs a baseline: current packages, a non-root user, key-only SSH, and automatic security updates.

## 1. Update the system and enable unattended upgrades

```bash
apt -y update
apt -y upgrade
apt -y full-upgrade
DEBIAN_FRONTEND=noninteractive apt-get --yes --force-yes upgrade
DEBIAN_FRONTEND=noninteractive apt-get --yes --force-yes dist-upgrade
apt -y install unattended-upgrades
systemctl enable unattended-upgrades
systemctl start unattended-upgrades
```

This brings everything up to date and ensures security patches are applied automatically going forward.

## 2. Create a non-root user

Running as root is convenient but risky. A dedicated user with `sudo` access is safer.

Set a username (replace `yourname` with your actual name):

```bash
USERNAME=yourname
```

Verify it took:

```bash
echo $USERNAME
```

Create the account with passwordless sudo:

```bash
adduser --disabled-password --gecos "" $USERNAME
usermod -aG sudo $USERNAME
cat >> /etc/sudoers <<<"$USERNAME ALL=(ALL) NOPASSWD: ALL"
```

## 3. Copy the SSH key to the new user

The SSH public key currently lives in root's home directory. Copy it to the new account:

```bash
mkdir /home/$USERNAME/.ssh
cp /root/.ssh/* /home/$USERNAME/.ssh
chmod 700 /home/$USERNAME/.ssh
chmod 600 /home/$USERNAME/.ssh/*
chmod 640 /home/$USERNAME/.ssh/authorized_keys
chown -R $USERNAME:$USERNAME /home/$USERNAME/.ssh
```

## 4. Harden SSH access

Disable password authentication entirely and prevent root login over SSH. After this, the only way in is with the correct private key:

```bash
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
cat >> /etc/ssh/sshd_config <<<'ChallengeResponseAuthentication no'
passwd -l root
usermod -p '*' $USERNAME
usermod -p '*' root
```

## 5. Reboot and verify

```bash
reboot now
```

The SSH connection drops. After a minute or so, reconnect with the new user:

```bash
ssh yourname@your-server-address
```

If you land on a prompt with your username, the server is ready for everything that comes next.
