Make a safe connection first
Open the provider web console before changing networking or SSH. It is your fallback if a configuration mistake blocks remote access. In the examples, replace 203.0.113.10 with the real IP. Do not paste passwords into commands or screenshots.
ssh root@203.0.113.10
On the first connection, SSH asks you to verify the host fingerprint. Compare it with the provider console when that value is available. A changed fingerprint later can mean the instance was rebuilt or that the connection needs investigation.
Record the baseline
Run the following commands before installing software. Save the output in a private deployment note; it makes later troubleshooting much easier.
cat /etc/os-release
uname -m
nproc
free -h
df -h
ip -brief address
Confirm a supported operating system, 64-bit architecture, expected CPU count, reasonable memory and enough space on the root filesystem. Stop if the instance does not match the order.
Update the operating system
Package indexes in a fresh image may already be old. Update them, install available security and bug-fix updates, and reboot if the system reports that a reboot is required.
apt update
apt upgrade -y
test -f /var/run/reboot-required && cat /var/run/reboot-required
Keep the SSH window open while upgrading. If a dialog asks whether to replace a configuration file you already changed, read the difference instead of accepting blindly.
Set identity and time
A useful hostname appears in logs and prompts. Use a neutral machine name rather than a secret or a full customer domain. Keep the system clock accurate; certificates, logs and scheduled jobs depend on it.
hostnamectl set-hostname web-01
timedatectl set-timezone Asia/Shanghai
timedatectl status
UTC is also a good server timezone if your team prefers it. The important part is consistency and documentation.
Create a daily administrator
Working as root all day makes every typo more dangerous. Create a named user, add it to the sudo group and test it in a second terminal before closing the root session.
adduser deploy
usermod -aG sudo deploy
su - deploy
sudo whoami
The expected result of sudo whoami is root. This does not secure SSH by itself; key authentication and firewall rules are the subject of the next article.
Optional swap for a small machine
A small server can run out of memory during package installation or a production build. First check swapon --show. If there is no swap, consider a modest swap file, but remember that swap prevents some crashes and does not replace RAM. Follow your provider's storage guidance before creating it.
What I learned
I used to install the application immediately and only later discovered that the clock, disk or OS image was wrong. Now I spend the first ten minutes recording a baseline. That small habit turns vague problems such as the server feels slow into facts that can be compared over time.
Finish line
You are done when the OS is updated, time is correct, hostname is clear, disk has room and the deploy user can run sudo. Keep the current root window open and continue with SSH keys and firewall hardening.