First-hour Ubuntu VPS security checklist

Create a recovery route before changing SSH

Confirm that you can connect using the supplied credentials and that you have console or recovery access if the firewall is misconfigured. Add a named non-root administrator with sudo permissions and install your SSH public key in that account. Open a second terminal and validate key authentication before disabling root SSH login or passwords.

A locked-out VPS often results from changing sshd_config and firewall rules simultaneously. Keep the original session open until the new session has been tested end to end.

Update and minimise exposed services

Run the distribution package updates and plan a reboot when the kernel changes. Inspect listening ports with ss and remove unused services. Configure a firewall that allows SSH only from intended networks where feasible, plus only the application ports that are actually required.

When using UFW, add the required SSH allow rule before enabling the firewall. A web server normally needs the applicable HTTP/HTTPS ports; a private database should not be exposed merely because the app connects to it locally.

Set up operational evidence

Configure time synchronisation, a backup destination, a patch schedule and a log retention policy. Verify that a backup can be restored to a separate location; a successful backup command without a restore test is not a recovery plan.

Before exposing a new website, check TLS certificate validity, file ownership, least-privilege service accounts and that configuration files containing secrets cannot be fetched over HTTP.

Does Rokocloud guarantee the features described in this guide?

No. This is practical evaluation and setup advice. Available plans, pricing, network controls, OS images, licensing and backups must be confirmed for the selected service before purchasing.