Skip to content
Bullionet
Getting started

First connection

Logging in over SSH for the first time, replacing the delivered password with a key, and a short hardening pass before the server sees traffic.

Log in ​

Use the primary IP address and the root credentials from your delivery email:

bash
ssh root@203.0.113.10

The first connection asks you to accept the server's host key. Accept it once, and note the fingerprint: if it ever changes without you reinstalling the system, stop and investigate before typing your password.

Replace the delivered password ​

The delivered password travelled through an email. Treat it as temporary.

bash
# 1. Create a user for daily work
adduser deploy
usermod -aG sudo deploy        # Debian, Ubuntu
# usermod -aG wheel deploy     # Rocky, AlmaLinux

# 2. Install your public key for that user
mkdir -p /home/deploy/.ssh
cat >> /home/deploy/.ssh/authorized_keys   # paste your key, then Ctrl-D
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys

Open a second terminal and check that ssh deploy@203.0.113.10 works before touching the SSH configuration. Keeping the first session open is what saves you if the new configuration is wrong.

Then disable password logins in /etc/ssh/sshd_config:

PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
bash
sshd -t && systemctl reload ssh    # 'sshd' on Rocky and AlmaLinux

Careful

sshd -t validates the configuration before the reload. Skipping it is how a typo turns into a machine you can only reach through the out-of-band console.

Update the system ​

bash
apt update && apt full-upgrade      # Debian, Ubuntu
dnf upgrade --refresh               # Rocky, AlmaLinux

A freshly installed image is as old as the image, not as old as today. Run this before exposing any service.

Close the ports you are not using ​

The server arrives reachable on every port. Nothing filters your inbound traffic except what you configure on the machine.

bash
# Debian, Ubuntu
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable

# Rocky, AlmaLinux
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

If you moved SSH to another port, allow that port before enabling the firewall.

Set the hostname and time ​

bash
hostnamectl set-hostname web-01.example.com
timedatectl set-timezone Europe/Paris
timedatectl set-ntp true

Correct time matters more than it looks: certificate validation, log correlation and any ticket you open with us all depend on it.

Where to go next ​

Reviewed on September 1, 2026