First login, and the ten minutes after it

Verify the host key first

Provisioning mails you an address, a root password and the SSH host key fingerprint. The same fingerprint is on the instance page in the panel. Compare them before you accept the key. If they disagree, do not type the password, and open a ticket.

ssh root@<ipv4>

The password we generate is not kept on our side once the mail has gone out. That is not a reason to keep using it.

Patch before anything else

Debian 13:

apt update && apt full-upgrade -y && apt autoremove -y

AlmaLinux 10:

dnf -y upgrade --refresh

A reboot is only needed if the kernel moved. On Debian needrestart tells you during the upgrade; on AlmaLinux, dnf needs-restarting -r answers the same question afterwards.

Make an account that is not root

adduser deploy
usermod -aG sudo deploy

On AlmaLinux the group is wheel and adduser is not interactive:

useradd -m -s /bin/bash deploy
usermod -aG wheel deploy
passwd deploy

Install your public key on that account now and test it from a second terminal. Locking SSH down before the key works is the single most popular route to the out-of-band console.

Harden sshd with a drop-in

Both images read /etc/ssh/sshd_config.d/, so write a file of your own and leave the packaged one alone. Upgrades then stop overwriting your work.

cat > /etc/ssh/sshd_config.d/10-local.conf <<EOF
PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
AllowUsers deploy
LoginGraceTime 20
MaxAuthTries 3
EOF
sshd -t

sshd -t parses the whole configuration and prints nothing when it is satisfied. Reload only after it has:

systemctl reload ssh    # Debian
systemctl reload sshd   # AlmaLinux

Keep the current session open while you test the new one. A reload does not drop existing connections, which is exactly the property you want when the configuration is wrong.

Changing the port is not hardening

Moving sshd to a high port shrinks your auth log. It does not change who can reach the daemon. If fewer strangers knocking is the goal, restrict the source addresses in nftables and leave the port where every piece of your tooling expects it.

The rest of the ten minutes

hostnamectl set-hostname edge-01
timedatectl set-timezone UTC

Then unattended security updates, because you will forget:

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

On AlmaLinux, install dnf-automatic, set apply_updates = yes in /etc/dnf/automatic.conf, and enable the timer:

dnf install -y dnf-automatic
systemctl enable --now dnf-automatic.timer

After that, the firewall, the reverse DNS on your address, and the routed IPv6 /64. All three have their own articles in the knowledge base.