Before deploying an application, confirm console access, install security updates, create a named admin account, add an SSH key, restrict inbound ports, and decide how the server will be restored. Keep the original access method working until the new login has been tested in a second session.
Key points
- Do not close the only working session while changing SSH access.
- Open only the ports the service needs and verify them from outside.
- A backup is useful only after a restore path has been tested.
Establish a recovery path first
Record the server address, selected Linux image, and where console or rescue access is available. Then log in, check the hostname, disk, memory, time, and package state before adding application data.
Create a named administrator with `sudo` and add an SSH public key. Test that account in a second terminal. Only after it works should you consider changing password authentication or root login settings.
Reduce the exposed surface
Install pending security updates, remove services you do not use, and define firewall rules for SSH and the application ports. Keep database and internal admin ports private unless there is a documented reason to expose them.
Use a service manager for the application and set a log retention policy. Unlimited logs can fill a small disk as effectively as application data.
- verify console or rescue access;
- test a named sudo account and SSH key;
- apply updates and reboot if required;
- allow only required inbound ports;
- configure monitoring, log limits, backup, and restore notes.
Deploy after the baseline is reproducible
Write down the packages, configuration, DNS records, and secret locations needed to rebuild the service. Automation is helpful, but even a short accurate runbook is better than a server nobody can recreate.
Take the first backup after the application is in a known-good state and restore it somewhere safe. Do not keep the only backup on the VPS it is meant to replace.
FAQ
Should I disable password login immediately?
First verify key-based login for a named administrator in a separate session and confirm console or rescue access. Changing the only working access path without a test can lock you out.
Which ports should a new VPS expose?
Only those required for administration and the public service. Typical web workloads need SSH plus HTTP/HTTPS, but the exact set belongs to the application design.
Sources
Technical statements are checked against primary documentation.