Skip to content

VPS setup⚓︎

How to setup your VPS

What is a VPS⚓︎

Your own space in the cloud, to host a website or app 24/7. It is most useful when running an application, because you can install the software of your choice.

Where to get a VPS⚓︎

Most website domain service providers also offer VPS (Virtual Private Server)

What to get⚓︎

When starting to learn something new, always choose the recommended option

For Ditto, when subscribing to a VPS plan, the recommendation is to have a server with Ubuntu software.

Point your domain to your server⚓︎

what you need

  1. domain name

  2. Your VPS plan (Ubuntu) will provide you with:

    • IP address for your server (using 111.111.11.11 here as an example, please replace with your own)

    • SSH port of access (often 22 or replace with what your provider gives you)

    • Root (admin) password

Your hosting provider should have a tutorial on how to point your domain name to your server's IP address. Sometimes, the steps can vary slightly from provider to provider, but it will look similar to this:

Record Host Value
A Record @ 111.111.11.11 (example, enter your own)
CNAME Record www yourdomain.ending

To check if your records point your website's domain to your IP you can enter the following command in your terminal:

dig yourwebsite.com ANY +noall + answer

recommended

password manager

For this process, you will need to keep track of a few passwords. Password managers can help both save them and generate new ones for you. Choose long strong passwords with numbers, a mixture of uppercase and lowercase letters, and special characters.

warnings exist for a reason, preventing future mistakes

My hosting provider had a security warning on running a VPS from a root (admin) user. I'm documenting the steps to their security recommendations here.

Secure your VPS⚓︎

remove root user & set up a custom one

Examples used in this tutorial, please substitute with your own:

IP: 111.111.11.11

custom port: 2140

server: server1

log in to your server (first time)⚓︎

using your terminal

your terminal will show you your home directory
yourname@yourcomputer ~ %

enter the following command to log in through ssh
ssh root@111.111.11.11 -p22
message from terminal
The authenticity of host '111.111.11.11 (111.111.11.11)' cannot be established. 
...fingerprint...
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/)?

enter yes
yes
success message from terminal
Warning: Permanently added '111.111.11.11' (RSA) to the list of known hosts.

new credentials⚓︎

log in, if not already
ssh root@111.111.11.11 -p22
enter the password your service provider gave you
root@111.111.11.11 s password:
message from terminal
Welcome to Ubuntu

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

New release '' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: date and time
[] [server1.yourdomain.ending ~] #

create a new user⚓︎

from your root directory
root@server1 ~ %

choose the name you're going to use to access your server (yourusername)

useradd -m -s /bin/bash -c "Admin"  yourusername

no message from terminal often means success

set a new password⚓︎

passwd yourusername
enter your desired password
New password:
Retype new password:
message from terminal, after entering a password and retyping it
passwd: password updated successfully
[] [root@server1 ~] #

give admin rights to yourusername⚓︎

usermod -aG sudo yourusername
no message from terminal often means success

test⚓︎

switch to your username
sudo su - yourusername
message from terminal, if this message does not appear, make sure you have given admin rights to yourusername (see one step above)
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
notice the directory change
yourusername@server1:~$
run this command as a test, it will request your password for your new user
sudo ls -la /root
if, after entering your password, you can see a list similar to the one below, your new user has admin/sudoer rights
total 21
drwx------   
drwxr-xr-x  
...

disable root⚓︎

open config file
sudo nano /etc/ssh/sshd_config

it will open a new window, look for PermitRootLogin (using the up and down arrows)
# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.
...
#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
set PermitRootLogin to no. Make sure there is no hashtag in front of it, unlike the other options. Hashtags are used to make comments that the program ignores.
# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.
...
#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

change the SSH port⚓︎

In the same window you have open, remove the hashtag from port 22 and add another port number of your preference (the example here is 2140).

You can check this list of ports to avoid choosing a number in conflict with another service.

find port 22
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

remove the hashtag from Port 22 and add another port of your preference
Port 22
Port 2140
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
Save with Ctrl + O

you'll see the following message highlighted in the bottom bar
File Name to Write: /etc/ssh/sshd_config

hit enter

Exit with Ctrl + X

Restart using one of the following three commands, if you get a command not found error, try a different one, until you don't get a message.

sudo /etc/init.d/sshd restart

sudo service sshd restart

sudo restart ssh

exit twice log out of the server
exit

Log back in with your custom port (2140 shown here as an example)

log in
ssh yourusername@111.111.11.11 -p2140

Make sure to enter the config file again and add a hashtag to comment out port 22

#Port 22
Port 2140
#AddressFamily any
#ListenAddress 0.0.0.0
#Lis

If you get a WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
See how to solve this issue at the bottom of this page.

SSH keys⚓︎

These keys (long strings of characters) will authenticate you to your server. Generate new keys with the following, if you already have one it will give you a warning that you'll overwrite it.

from your home directory, in your terminal

ssh-keygen -t rsa

press enter to accept their recommended directory path
Generating public/private rsa key pair.
Enter file in which to save the key (/recommended-path):
enter a strong password
Enter passphrase (empty for no passphrase):
you'll get a similar message to this, along with randomart
Your identification has been saved in
Your public key has been saved in
The keys randomart image is

check if your keys exist, listed as id_rsa and id_rsa.pub
ls -la ~/.ssh/

You can share your public key (id_rsa.pub).

Do NOT upload nor share your secret or private key, in this case, id_rsa (without the .pub at the end).

deeper dive on passwords for SSH keys

a good explanation on public keys and private keys and why they help in connecting to a server

copy your SSH keys to the server⚓︎

from your home directory yourusername@yourcomputer
ssh-copy-id -p 2140 yourusername@111.111.11.11
message from terminal, it will request your server password
source of keys to be installed
...
number of keys added: 1
Now try logging into the machine and check to make sure that only the key(s) you wanted were added

Log in with your custom settings⚓︎

log back in

enter your keys password
ssh yourusername@111.111.11.11 -p2140
you'll get a message like this one
Welcome to Ubuntu

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

New release '' available.
Run 'do-release-upgrade' to upgrade to it.

Last login: date and time
[] [server1.yourdomain.ending ~] #
check if your key has been saved
nano ~/.ssh/authorized_keys
you should see your key in a new window
ssh- ...

exit with Ctrl + X

Update⚓︎

When you log in, remember to update your server's software. 

sudo apt update
message from terminal
Hit:1 http://us.archive.ubuntu.com/ubuntu focal InRelease
Get:2 http://us.archive.ubuntu.com/ubuntu focal-updates InRelease [128 kB]
...
All packages are up to date.

If the message above mentions that packages could be upgraded, run the command below.

sudo apt upgrade
message terminal gives
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following NEW packages will be installed:
...
Do you want to continue? [Y/n]

Y

You should see a progress bar at the bottom.

If you get a message to restart services in order to update Kernel. Hit enter. It will list which ones need to be restarted. Hit enter again.

It will then display a list of items and say that nothing needs to be restarted, nor is anything outdated.

Reboot⚓︎

(Also run reboot if a message to restart appears as you log in)

sudo reboot now

log in, again

Ditto⚓︎

Install Ditto.

Setup a firewall⚓︎

After installing your application, setup your firewall, and test live to make sure it doesn't block it.

Restart from scratch⚓︎

Learning about tech means learning to make mistakes and trying again.

If you reinstall your server to try this process again from scratch, on the same server IP, you will get a scary warning like this one:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
Don't worry, you can fix it by removing your old key from the known_hosts file an making a copy of it in a separate folder, just in case.

from your computer's home directory, using terminal

ssh-keygen -R 111.111.11.11
message from terminal
# Host 111.111.11.11 found: 
/route/ updated
Original contents retained as /route-for-old-keys

If you still cannot log in after that. The error message will give you a directory path at the bottom. The last numbers after the colon indicate the line you need to find and delete.

/thedirectory/path/it/gives/you/known_hosts:21

get to the right directory (leave out the known_hosts file name, the colon, and the line number)
cd /thedirectory/path/it/gives/you/.ssh
list the files in the directory, known_hosts should be one of the files
ls

open the known_hosts file, it will ask for your computer password
sudo nano known_hosts
It will open up a new window. You can delete the "offending" line. It will start with the server's IP.

Ctrl + O to save

Ctrl + X to exit the window

go back to your home folder and log in again
cd ..

Now create your SSH keys to authenticate to your server. The steps will change, as the terminal will ask you to overwrite your key. Say yes.

sources:

How to Fix Warning Remote Host Identification Has Changed

Removing an SSH Public Key for user