How to set up a Rocky Linux VPS: first steps after you get root

Rocky Linux 9 is the free RHEL-compatible choice: same packages, same dnf, same firewalld and SELinux. If you've set up Debian or Ubuntu, the order of steps is identical; the tools differ. This is the first ten minutes on a fresh Rocky 9 server.

Every command below was run on our Rocky Linux 9 image before publishing. On a clean server the whole sequence takes a couple of minutes.

1. Update the system

Log in as root with the password from your dashboard and update:

dnf -y upgrade

On our image it finished in seconds when we tested it, because the image was already current.

2. Create a sudo user and add your SSH key

On Rocky the admin group is wheel, not sudo:

useradd -m -G wheel deploy
passwd deploy                      # sudo will ask for this password

Put your public key on the server (how to create one). If you copied it to /root/key.pub:

install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
install -m 600 -o deploy -g deploy /root/key.pub /home/deploy/.ssh/authorized_keys
restorecon -R /home/deploy/.ssh

restorecon sets the SELinux labels sshd expects. Without the right label, key login fails with no obvious error.

Open a second terminal and check that ssh deploy@YOUR.SERVER.IP works and sudo -v accepts the password. Keep the root session open until it does.

3. Turn off root and password login

This is where Rocky differs from a textbook sshd_config edit. Settings live in drop-in files under /etc/ssh/sshd_config.d/, and sshd uses the first value it finds. On our image the first file is 00-eqvps.conf, which allows root and password login so you can get in on day one. Change it there:

sed -i -e 's/^PermitRootLogin .*/PermitRootLogin no/' \
       -e 's/^PasswordAuthentication .*/PasswordAuthentication no/' \
       /etc/ssh/sshd_config.d/00-eqvps.conf
sshd -t && systemctl reload sshd
sshd -T | grep -E '^(permitrootlogin|passwordauthentication) '

The last command prints what sshd will actually enforce. You want:

permitrootlogin no
passwordauthentication no

After this, ssh root@… is refused even with a key, and deploy logs in with the key only.

4. Firewall: firewalld

The cloud image doesn't include firewalld. Install it, start it, and keep only what you need:

dnf -y install firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --remove-service=cockpit
firewall-cmd --reload
firewall-cmd --list-services

The default zone opens cockpit (port 9090) and dhcpv6-client. Cockpit isn't installed, but there's no reason to leave its port open. When you add an app, open its port the same way, for example firewall-cmd --permanent --add-service=https.

5. Automatic security updates

dnf-automatic downloads updates on a timer. By default it doesn't install them, so switch that on:

dnf -y install dnf-automatic
sed -i 's/^apply_updates = .*/apply_updates = yes/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

If you'd rather get security fixes only, also set upgrade_type = security in the same file.

6. Leave SELinux on

getenforce prints Enforcing on a fresh server, and everything above works with it. When an app needs a non-standard port or directory, the fix is a label (semanage port, restorecon), not setenforce 0.

Which plan

Rocky 9 uses about 400 MB of RAM at idle. The Nano plan (1 GB, $3/mo) is enough for a single small service; Micro (2 GB, $5/mo) leaves room for a database. On NAT plans SSH comes in through a personal port shown in the dashboard. If you need ports 80/443 open to the world, take a plan with its own IPv4, such as Micro-IP at $10/mo.

Rocky Linux 9 is one of the images on the RHEL-family OS page and on every plan in VPS plans. Payment is in USDT, USDC or ETH on Base, Ethereum or Polygon. No ID or card is needed. If you'd rather drive the server from scripts, the API docs cover ordering, reinstalling and renewal.