Securing a new server: checklist

Below are the security steps for a new server, in the order you do them. Some are done in the app.blackbox.md panel, on the server card on the “My Servers” page (app.blackbox.md/my-servers, left menu “Infrastructure” → “My Servers”), and the rest on the server itself, over SSH, as root. The commands are for the Ubuntu, Debian, AlmaLinux and CentOS Stream images.

Available to: the blackbox.md account holder who ordered the server. The panel buttons don't appear on cards marked “Managed”; for those servers, write to us.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Warning There is no web or VNC console for customers: if you lose SSH access and the panel can't reach the server either, only support can help you. While you change SSH or firewall settings, keep a second SSH session open, and close it only after you have connected from a new terminal. Don't delete the “Management key (blackbox.md)” from /root/.ssh/authorized_keys: the panel buttons work through it.

The checklist at a glance

1. Update the system

Connect to the server (Connecting to your server over SSH (Windows, macOS, Linux)) and install the updates.

Ubuntu and Debian

apt update
apt upgrade -y

AlmaLinux and CentOS Stream

dnf upgrade -y

On Ubuntu, a needrestart window may appear asking which services to restart: keep the suggested selection and press Enter.

If the kernel was updated (the linux-image-… packages on Ubuntu and Debian, kernel on AlmaLinux and CentOS Stream), reboot the server with “Reboot” on the card (Rebooting, stopping and starting a server) and connect again after a minute. On Ubuntu, if the file /var/run/reboot-required exists, a reboot is needed.

2. Change the root password you received by email

If you didn't attach an SSH key when you ordered, or you unchecked “Dezactivează autentificarea prin parolă (doar cheie SSH)” (Disable password authentication (SSH key only)), your root password arrived in the “Serverul dvs. este gata — BBX-…” (Your server is ready — BBX-…) email. Replace it:

1. On the server card, click “Reset password”.
2. Confirm the message “Reset the password for SERVER_NAME? The current password stops working immediately.” with “OK”.
3. The new password appears on the card, in the box with “Username” and “Password”. Save it in a password manager.

The panel keeps the new password, so you can view it again at any time with “Reveal credentials”. You can also change it on the server with passwd, but then the panel keeps showing the old password, and only you know the new one. If you ordered the server key-only, the email doesn't contain a password: go to step 3.

3. Add your SSH key and test it

If you attached the key when you ordered, it's already on the server: go straight to the test (item 5). Otherwise:

1. If you don't have a key, create one on your computer: Generating an SSH key (Windows, macOS, Linux).

2. On the server card, click “Add SSH key”.

3. Choose “Use a saved key” and pick the key from the list, or choose “Paste a new key” and paste the public key line (ssh-ed25519 AAAA…).

4. Click “Add key”. “Key added.” appears, and the key shows up in “Installed keys”.

5. In a new terminal, connect using only the key:

   ssh -o PreferredAuthentications=publickey root@SERVER_IP

If you connect (possibly after entering the key's passphrase), the key works: leave this session open for the next steps. If you see Permission denied, don't continue: check the key with Adding and removing SSH keys on the server.

4. Disable password login in the panel

If you ordered the server key-only, the badge next to the server's name already shows “Key-only”: go to step 5.

1. On the server card, click “Disable password login”.
2. Confirm “Disable SSH password login on SERVER_NAME? After this, only installed SSH keys can log in. The console password still works.” with “OK”.
3. The badge next to the server's name changes to “Key-only”, and the button changes to “Enable password login”.
4. From a new terminal, check that you can connect with the key (the command from step 3).

The “console password” in the message is the root password saved in the panel: it stays set, but it no longer works over SSH. Customers don't have a web console.

Don't edit PasswordAuthentication in /etc/ssh/sshd_config. The button writes the setting to a separate file in /etc/ssh/sshd_config.d/, which takes precedence over the main file, and then checks it on the server. If you see “No installed key found — add a key before disabling password login.”, go back to step 3.

5. Create a user with sudo rights (optional)

If you'd rather work day to day as a user other than root, create one. The root account stays active and reachable with a key: the panel and the AI assistant use it.

Ubuntu and Debian

adduser USERNAME
usermod -aG sudo USERNAME

adduser asks you for the new user's password (you'll use it with sudo); you can leave the other fields empty. On Debian, if the sudo command is missing, install it:

apt install -y sudo

AlmaLinux and CentOS Stream

adduser USERNAME
passwd USERNAME
usermod -aG wheel USERNAME

The new user's SSH key

Copy root's authorized keys:

mkdir -p /home/USERNAME/.ssh
cp /root/.ssh/authorized_keys /home/USERNAME/.ssh/authorized_keys
chown -R USERNAME:USERNAME /home/USERNAME/.ssh
chmod 700 /home/USERNAME/.ssh
chmod 600 /home/USERNAME/.ssh/authorized_keys

On AlmaLinux and CentOS Stream, also restore the directory's SELinux context:

restorecon -R /home/USERNAME/.ssh

The copy also contains the BLACKBOX keys (BLACKBOX keys on your server). The new user doesn't need them: you can delete them from /home/USERNAME/.ssh/authorized_keys, but never from /root/.ssh/authorized_keys.

Test from a new terminal. Connect as the new user:

ssh USERNAME@SERVER_IP

Then run the command below on the server. After you enter the user's password, it must print root.

sudo whoami

6. Keep root login with a key

The right setting is PermitRootLogin prohibit-password: root logs in only with a key, and the root password can no longer be guessed over SSH. Step 4 (or a key-only order) already sets it, so you don't need to edit anything. Check the settings that are actually in effect:

sshd -T | grep -Ei 'passwordauthentication|permitrootlogin'

The output must contain passwordauthentication no and permitrootlogin prohibit-password. Some OpenSSH versions show permitrootlogin without-password: it's the same setting under its old name.

Important Don't set PermitRootLogin no. The panel (“Reset password”, “Installed keys”, the password login buttons) and the AI assistant connect as root with the BLACKBOX management key. With no, these features stop working, and without a web console you can't fix them from the panel.

If you have already set PermitRootLogin no (for example, following an older guide), connect as the user with sudo rights and become root:

sudo -i

In the file where you wrote the setting, replace the line with PermitRootLogin prohibit-password. Then check the configuration and reload SSH:

sshd -t
systemctl reload ssh || systemctl reload sshd

sshd -t prints nothing if the configuration is correct. If it prints an error, fix it before reloading. If you don't have another user with sudo, write to support: Lost access to your server (password or key).

7. Turn on the firewall, allowing SSH first

The network filtering managed by BLACKBOX lets SSH (22), HTTP (80), HTTPS (443) and ping through to the server. The system firewall (ufw or firewalld) is off on a new server.

Allow SSH before you turn on ufw, or you'll lock yourself out. Don't restrict port 22 to your own IP address only: the panel connects to the server on this port. After turning the firewall on, and without closing your current session, check from a new terminal that you can still connect.

If the server has a control panel installed (the “VPS hosting” plans), ask support first: that control panel may have its own firewall and its own fail2ban, and two active firewalls can conflict.

Ubuntu and Debian

apt install -y ufw
ufw allow 22/tcp
ufw enable

When asked “Command may disrupt existing ssh connections. Proceed with operation (y|n)?”, answer y.

AlmaLinux and CentOS Stream

The default firewalld zone already allows SSH, so starting it won't disconnect you. The third command makes the rule permanent.

dnf install -y firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

Ports for a website

For a website, also allow ports 80 and 443; for other ports, read Firewall: network filtering and ufw/firewalld on the server.

8. Install fail2ban

fail2ban temporarily blocks IP addresses that repeatedly try to guess passwords over SSH.

Ubuntu and Debian

apt install -y fail2ban python3-systemd

AlmaLinux and CentOS Stream

The package comes from the EPEL repository. fail2ban blocks addresses through firewalld, so do step 7 first.

dnf install -y epel-release
dnf install -y fail2ban python3-systemd

On all systems

Turn on SSH protection, start the service and check it:

printf '[sshd]\nenabled = true\nbackend = systemd\n' > /etc/fail2ban/jail.local
systemctl enable fail2ban
systemctl restart fail2ban
fail2ban-client status sshd

The last command must show “Status for the jail: sshd”. If it says it can't connect to the service, wait a few seconds and run it again. Detailed setup: Protection against password-guessing attempts with fail2ban.

9. Turn on automatic security updates

Ubuntu and Debian

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

When asked “Automatically download and install stable updates?”, answer “Yes”. On Ubuntu, the package is usually already installed, and the commands confirm that it's active.

AlmaLinux and CentOS Stream

dnf install -y dnf-automatic
systemctl enable --now dnf-automatic-install.timer

The timer downloads and installs all available updates every day.

Automatic updates don't reboot the server: a new kernel takes effect only after a reboot (step 1). Details and settings: System updates and automatic security updates.

10. Plan your backups

BLACKBOX does not make automatic backups of your server, and the data on it is your responsibility (Responsibility for server data and backups). The “Backups” button on the server card is not active: if you click it, it may show backup_extra_disabled.

Make regular copies of your files and databases, keep at least one copy off the server, and check from time to time that you can restore it: Backup strategy for your server.

11. Check the “Monitoring” page (if you have the Monitoring service)

This step is for servers with the “Monitoring 24/7” add-on service, available for Ubuntu and Debian (The Monitoring service: the agent installed on the server).

1. In the panel, open “Monitoring” (app.blackbox.md/monitoring).
2. In the “Your servers” table, the server's “Monitoring” column must show “Active”. “Connecting…” means the agent is still being installed; if you see “Failed”, write to us.
3. In the “Alerts” card, under “Notification preferences”, leave “Email me when a new alert fires” checked, choose the level in “Minimum severity” and click “Save” (Alerts and email notifications).

The agent sends data over outgoing connections, which ufw and firewalld allow by default. Don't block the server's outgoing traffic.

Frequently asked questions

Can I move SSH to another port? We don't recommend it. By default, the network filtering lets through only the ports from step 7, so SSH on another port may become unreachable, and the panel connects on port 22. If you need another port, ask support first: How to contact BLACKBOX support.

The old article “Securizarea de bază a unui VPS” (Basic VPS security) in the “Bază de cunoștințe” (Knowledge base) recommended something different. Which one should I follow? This one. The old article recommended PermitRootLogin no and editing PasswordAuthentication in /etc/ssh/sshd_config; both conflict with the panel. This guide replaces those recommendations.

I've lost access to the server. What do I do? If the panel buttons still work, click “Enable password login” and connect with the password shown by “Reveal credentials” (if you changed it with passwd, click “Reset password” first). After you fix key access, disable password login again (step 4). If the panel can't reach the server either (for example, the firewall blocks port 22), follow Lost access to your server (password or key).

Does the “Monitoring” page show whether the server is secure? No. It shows the load (CPU, RAM, disk, processes) of servers with the Monitoring service. Check the settings from this guide on the server itself, with the commands above.