Your new server: what you get and first steps

This article explains what a new server includes right after activation (the system, resources, IP address, root access, SSH keys and network rules) and what to do in the first few minutes. You'll find the server in the app.blackbox.md panel, in the “My Servers” menu (app.blackbox.md/my-servers), and the access details come in the email “Serverul dvs. este gata — BBX-…” (Your server is ready — BBX-…): After payment: server activation and emails.

Available to: the blackbox.md account holder who ordered a VPS plan or a “VPS hosting” plan. Dedicated servers are prepared manually by our team, and you agree on their configuration with us: Dedicated servers.

What you get

The root password and the login method

Each server gets a randomly generated 22-character root password (letters, digits, - and _). The password does not expire: the system does not make you change it at your first login. You chose the login method when you ordered (The SSH key at order time and “key-only” servers), and the server card shows it with a badge:

To change the password so that the panel knows the new one, use “Reset password”: Resetting the root password. If you change it on the server with passwd, “Reveal credentials” keeps showing the old password.

SSH keys on the server

A new server's /root/.ssh/authorized_keys file can contain three kinds of keys. You can see them on the server card: “Add SSH key” → “Installed keys”.

Details: BLACKBOX keys on your server.

Important Don't remove “Management key (blackbox.md)” from authorized_keys, and don't set PermitRootLogin no: the panel connects as root with this key. If you want to restrict root login, use PermitRootLogin prohibit-password (root with a key only). Otherwise, the panel buttons stop working.

Network and ports

Incoming traffic to the server passes through two layers:

• The panel has no firewall settings. For another port (for example 8080), write to support with the server's IP address and the port: How to contact BLACKBOX support.
• Traffic reaches your application only if the port is open in both layers. Details: Firewall: network filtering and ufw/firewalld on the server.

The server name

In the panel, the server appears under its internal name bbx-bbx-…. To show a different name, click the “Rename” pencil: only you see the new name, and the server itself doesn't change (Renaming a server (private name)). If you want, you can change the system's hostname yourself:

hostnamectl set-hostname HOSTNAME

First steps: checklist

Warning Customers have no web or VNC console: you manage the server over SSH. When you change SSH settings or the firewall, keep a second SSH session open until you have checked that you can connect again. If you lose access, write to support: Lost access to your server (password or key).

1. Connect over SSH. The email may arrive about a minute before the server responds; if your first attempt fails, try again a minute later. Details: Connecting to your server over SSH (Windows, macOS, Linux).

   ssh root@SERVER_IP

2. Update the system. Ubuntu and Debian:

   apt update
   apt upgrade -y

   AlmaLinux and CentOS Stream:

   dnf upgrade -y

   If the kernel was updated, restart the server (“Reboot” in the panel). Automatic updates: System updates and automatic security updates.

3. Add your SSH key and test it. If you didn't attach a key to the order, generate one (Generating an SSH key (Windows, macOS, Linux)) and add it with “Add SSH key” (Adding and removing SSH keys on the server). In a second terminal, check that you can log in with the key.

4. Switch to key-only login. Once the key works, click “Disable password login” on the card and confirm. Don't edit PasswordAuthentication in /etc/ssh/sshd_config: the button writes a setting that takes precedence. Details: Enabling and disabling SSH password login. To check on the server (the expected result is passwordauthentication no):

   sshd -T | grep -i passwordauthentication

5. Turn on the firewall, allowing port 22 first. Ubuntu and Debian (on Debian, you need to install ufw):

   apt install -y ufw
   ufw allow 22/tcp
   ufw enable

   When you see the question “Command may disrupt existing ssh connections. Proceed with operation (y|n)?”, answer y. AlmaLinux and CentOS Stream (the default zone already allows SSH, and the third command confirms it):

   dnf install -y firewalld
   systemctl enable --now firewalld
   firewall-cmd --permanent --add-service=ssh
   firewall-cmd --reload

   For a website, also allow 80 and 443: Firewall: network filtering and ufw/firewalld on the server.

6. Install fail2ban, which blocks addresses that try to guess passwords: Protection against password-guessing attempts with fail2ban.

7. Plan your backups. BLACKBOX does not make automatic backups of your server: Backup strategy for your server.

8. Check the “Monitoring” page in the panel menu: The “Monitoring” page. Live charts (CPU, RAM, disk) appear for servers with the Monitoring add-on service: The Monitoring service: the agent installed on the server.

The full list, with explanations: Securing a new server: checklist.

Frequently asked questions

If I stop my server, do I pay less? No. A server stopped with “Stop” is still billed at the plan price. Billing stops only when you delete the server: Permanently deleting a server.

Can I move SSH to a different port? We don't recommend it. By default, the network filtering lets through only the ports listed above, and “Reset password”, “Add SSH key” and the AI assistant connect to the server on port 22. On a different port, these features stop working, and SSH may become unreachable.

In “Installed keys” I see keys I didn't add. What are they? Every new server has the two BLACKBOX keys: “Management key (blackbox.md)” and the key with the comment blackbox-agent-…. If a key is neither yours nor one of these two, remove it and write to support.

The email mentions a VNC console. Where do I find it? Customers have no web or VNC console. What the email calls the “parola de consolă” (console password) is the root password, which you can see with “Reveal credentials”. On a “Key-only” server, it doesn't work over SSH while password authentication is disabled.