This guide is designed for the absolute beginner. We will walk through the first essential steps to secure your server, get it ready for projects, and host your first website securely with Nginx and a free SSL certificate.

1. Your First Login: The Root User

Your hosting provider will give you an IP address (e.g., 123.45.67.89) and a password for the root user. The root user is the super-administrator with unlimited power. It’s powerful, but also risky to use for everyday tasks.

Step 1: Connect to the Server

Open a terminal on your computer and connect to your server using the ssh command.

ssh root@YOUR_SERVER_IP

Step 2: Change the Root Password

If your provider gave you a temporary password, your first action should be to change it to something strong and unique.

passwd

2. Create Your Own User Account

This is the single most important security step. We will create a standard user account and give it administrative privileges using the sudo command.

Step 1: Create the New User

Replace devuser with a username you like.

adduser devuser

Step 2: Grant Administrative Privileges

Add your new user to the sudo group, which allows it to run commands as the administrator.

usermod -aG sudo devuser

Step 3: Log in as Your New User

Log out of the root account (exit) and log back in with your new credentials.

ssh devuser@YOUR_SERVER_IP

From now on, you should always log in with this user.

3. Update System and Install Essential Tools

Now that you are logged in as your new sudo user, the first actions are to update the server and install some essential tools.

Step 1: Update the System

This command downloads the latest list of available software (update) and then installs those updates (upgrade).

sudo apt update && sudo apt upgrade -y

Step 2: Install Basic Tools

Next, install a few common and useful tools.

sudo apt install curl git vim htop unzip nginx -y

We include Nginx here as it is a lightweight, high-performance web server we will configure later.

4. Set Your Timezone

Correct server time is important for logs and many applications. Find your timezone from the list and set it.

# Find your timezone (press 'q' to quit the list)
timedatectl list-timezones

# Set your timezone (replace with your own)
sudo timedatectl set-timezone Asia/Kolkata

5. Basic Firewall Setup

A firewall is a digital security guard. We will use ufw (Uncomplicated Firewall) to block unwanted traffic.

Step 1: Allow Essential Traffic

This is critical: You must allow SSH traffic, otherwise the firewall will lock you out. We will also allow Nginx traffic.

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'

‘Nginx Full’ allows traffic on both HTTP (port 80) and HTTPS (port 443).

Step 2: Enable the Firewall

Now, turn the firewall on.

sudo ufw enable

6. Host a Website with Nginx

Now we will configure Nginx to serve a website for a domain you own.

Step 0: Point Your Domain to the Server (DNS)

Before Nginx can work, you have to tell the internet that your domain should point to your server’s IP address. You do this at your domain registrar (the company where you bought your domain, like GoDaddy, Namecheap, Google Domains, etc.).

1. Log in to your domain registrar’s website.
2. Find the DNS management page for your domain.
3. You need to create two ‘A’ records:
   • Record 1 (Root Domain):
     • Type: A
     • Host/Name: @ (this symbol represents the root domain itself)
     • Value/Points to: Your server’s IP address (e.g., 123.45.67.89)
     • TTL (Time to Live): Leave as default (often 1 hour).
   • Record 2 (www subdomain):
     • Type: A
     • Host/Name: www
     • Value/Points to: Your server’s IP address (the same one)
     • TTL: Leave as default.

DNS changes can take anywhere from a few minutes to a few hours to update across the internet.

Step 1: Create a Directory for Your Site

We’ll store our website’s files in the /var/www directory.

# Create a directory for your domain
sudo mkdir -p /var/www/your-domain.com/html

# Assign ownership to your user
sudo chown -R $USER:$USER /var/www/your-domain.com/html

Step 2: Create a Sample Page

Let’s create a simple index.html file for testing.

echo "<h1>Hello from my Nginx Site!</h1>" | sudo tee /var/www/your-domain.com/html/index.html

Step 3: Create an Nginx Server Block

Nginx uses “server block” files to know how to handle incoming domains. We’ll create one for our domain.

sudo nano /etc/nginx/sites-available/your-domain.com

Paste the following configuration into the file:

server {
    listen 80;
    listen [::]:80;

    root /var/www/your-domain.com/html;
    index index.html;

    server_name your-domain.com www.your-domain.com;

    location / {
        try_files $uri $uri/ =404;
    }
}

Step 4: Enable the Server Block

We enable the site by creating a symbolic link from this file into the sites-enabled directory.

sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/

Now, test your Nginx configuration for errors and restart it.

sudo nginx -t
sudo systemctl restart nginx

Once your DNS has updated, if you visit http://your-domain.com in a browser, you should see your “Hello World” message.

7. Secure Your Site with SSL (HTTPS)

To secure your site, we’ll get a free SSL certificate from Let’s Encrypt using a tool called Certbot.

Step 1: Install Certbot

Certbot has a dedicated Nginx plugin that makes the process simple.

sudo apt install certbot python3-certbot-nginx -y

Step 2: Obtain the SSL Certificate

Run Certbot. It will read your Nginx configuration, see the domain you just set up, and guide you through obtaining the certificate.

sudo certbot --nginx

Certbot will ask for your email, for you to agree to the terms of service, and if you want to redirect all HTTP traffic to HTTPS. It is highly recommended to choose the redirect option.

Step 3: Verify Auto-Renewal

Let’s Encrypt certificates are valid for 90 days. Certbot automatically sets up a task to renew them for you. You can test the renewal process with a dry run.

sudo certbot renew --dry-run

If this runs without errors, you are all set. Your site is now secure and accessible via https://your-domain.com.

To add a subdomain (e.g., blog.your-domain.com), you simply repeat the process: create a new directory in /var/www, create a new server block file in sites-available, enable it, and then run sudo certbot --nginx again.

8. Quick Tips and Best Practices

• Use SSH Keys: Passwords can be cracked. SSH keys are a much more secure way to log in. This is a highly recommended next security step.

• Keep Your System Updated: Get in the habit of running sudo apt update && sudo apt upgrade -y at least once a week.

• Be Careful with Commands: Don’t run scripts or commands from the internet without understanding what they do.

• Use Strong Passwords: The password for your sudo user should be strong and unique.

1. Prerequisites

Before you begin, ensure you have the following:

• A server running a Debian-based Linux distribution.
• sudo or root access to the server.
• A Telegram account.
• curl and jq installed on your server. If you don’t have them, install them now:

  sudo apt-get update && sudo apt-get install -y curl jq
  

2. Create a Telegram Bot

Your alerts will be sent by a Telegram Bot.

Step 1: Talk to BotFather

In your Telegram app, search for the verified BotFather account and start a chat.

Step 2: Create the Bot

Send the /newbot command. Follow the prompts to give your bot a display name and a unique username, which must end in bot.

Step 3: Save the API Token

Once created, BotFather will provide a secret API token. Copy this token and keep it secure; you will need it in the next steps.

3. Get Your Personal Chat ID

The bot needs to know where to send the alerts. This will be your personal Telegram chat.

Step 1: Start a Chat with Your Bot

Search for your new bot in Telegram and send it any message (e.g., /start). This initializes the chat.

Step 2: Retrieve the Chat ID

In your server’s terminal, run the following command. Replace <YOUR_BOT_TOKEN> with the token you saved from BotFather.

curl -s "https://api.telegram.org/bot<YOUR_BOT_TOKEN>/getUpdates" | jq '.result[0].message.chat.id'

This command will output a long number, which is your Chat ID. Copy it.

4. Create the Notification Script

This shell script will be triggered on login, gather information, and send the alert.

Step 1: Create the Script File

Using a text editor, create a new file for the script:

sudo nano /usr/local/bin/ssh-login-alert.sh

Step 2: Add the Script Content

Paste the following code into the file. Remember to replace the placeholder values for BOT_TOKEN and CHAT_ID with your actual credentials.

#!/bin/bash

# --- Replace with your details ---
BOT_TOKEN="<YOUR_BOT_TOKEN>"
CHAT_ID="<YOUR_CHAT_ID>"
#----------------------------------

# Do nothing if not an interactive session
if [ -z "$PAM_TYPE" ] || [ "$PAM_TYPE" != "open_session" ]; then
    exit 0
fi

# Gather login information
HOSTNAME=$(hostname)
USER=$PAM_USER
IP_ADDRESS=$PAM_RHOST
TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")

# Format the message using Markdown
MESSAGE=$(cat <<EOF
🔔 *New SSH Login Detected* 🔔

*Server:* \`$HOSTNAME\`
*User:* \`$USER\`
*From IP:* \`$IP_ADDRESS\`
*Time:* \`$TIMESTAMP\`
EOF
)

# Send the message via the Telegram API
curl -s --max-time 10 -X POST "https://api.telegram.org/bot$BOT_TOKEN/sendMessage" \
     -d chat_id="$CHAT_ID" \
     -d text="$MESSAGE" \
     -d parse_mode="Markdown" > /dev/null

Step 3: Make the Script Executable

Save the file and make it executable so the system can run it.

sudo chmod +x /usr/local/bin/ssh-login-alert.sh

5. Configure PAM to Trigger the Script

We’ll use the Pluggable Authentication Module (PAM) framework to execute our script whenever a user opens a new SSH session.

Step 1: Edit the SSHD PAM Configuration

Open the PAM configuration file for the SSH daemon:

sudo nano /etc/pam.d/sshd

Step 2: Add the Execution Rule

Add the following line at the very end of the file. This tells PAM to run our script for every session, but our script is smart enough to only act on SSH logins.

# Run script for SSH login notification
session optional pam_exec.so /usr/local/bin/ssh-login-alert.sh

Save and close the file.

6. Test the Setup

You’re all set! To test the notification, log out of your server and log back in via SSH.

exit

ssh your_user@your_server_ip

Within seconds, you should receive a neatly formatted notification on Telegram from your bot. If you don’t, double-check that the BOT_TOKEN and CHAT_ID in your script are correct and that the script is executable.

1. Initial Server Setup

After acquiring a VPS, you’ll get an IP address and root access. Your first steps are to secure the server and create a non-root user for daily operations.

Connect to your server via SSH:

ssh root@YOUR_SERVER_IP

Create a Sudo User

Operating as root is risky. Create a new user and grant administrative privileges.

# Create the new user (replace 'devuser' with your username)
adduser devuser

# Add the user to the 'sudo' group
usermod -aG sudo devuser

Now, set up SSH key authentication for your new user for enhanced security and convenience, then log in as that user.

2. Essential Security and Updates

A public server is a constant target. Secure it immediately.

Configure the Firewall

ufw (Uncomplicated Firewall) makes this easy. We’ll allow SSH, HTTP, and HTTPS traffic.

# Allow OpenSSH (so you don't lock yourself out)
sudo ufw allow OpenSSH

# Allow Nginx to handle web traffic on ports 80 and 443
sudo ufw allow 'Nginx Full'

# Enable the firewall
sudo ufw enable

After enabling, check its status to ensure it’s active and your rules are loaded.

sudo ufw status

Update Your Server

Keep your system’s packages current to patch security vulnerabilities.

sudo apt update && sudo apt upgrade -y

3. Installing and Understanding Nginx

Nginx is the heart of our setup. It’s a high-performance web server that can also act as a reverse proxy, load balancer, and more.

# Install Nginx
sudo apt install nginx -y

While the package should start and enable Nginx automatically, it’s good practice to run the commands explicitly to be sure.

# Start the Nginx service
sudo systemctl start nginx

# Enable Nginx to start automatically on boot
sudo systemctl enable nginx

# Now, check that it's running and enabled
sudo systemctl status nginx

You should see active (running) in the output. Visiting your server’s IP in a browser should also show the Nginx welcome page.

Nginx Configuration Structure

Nginx’s configuration lives in /etc/nginx. The -p flag in the commands below ensures that the command does nothing if the directories already exist.

sudo mkdir -p /etc/nginx/sites-available
sudo mkdir -p /etc/nginx/sites-enabled

The key directories are:

• /etc/nginx/nginx.conf: The main configuration file. You rarely edit this.
• /etc/nginx/sites-available/: Where you store the configuration files for each of your sites (called “server blocks”).
• /etc/nginx/sites-enabled/: Where you create symbolic links to the configurations in sites-available that you want to be active.

This structure lets you easily enable or disable sites without deleting their configuration files.

4. Advanced Hosting: Subdomains and Reverse Proxies

This is where the magic happens. A single server can host a blog, a portfolio website, a web app, and several APIs, all neatly organized using subdomains.

The core concept is the Reverse Proxy. Your Nginx server listens on the standard web ports (80 for HTTP, 443 for HTTPS) and intelligently forwards incoming requests to the correct internal service based on the requested domain or subdomain.

Scenario:

Let’s say we want to set up the following on our server:

1. eknath.dev: A static HTML/CSS website.
2. blog.eknath.dev: A separate project, maybe a Hugo or Jekyll site.
3. api.eknath.dev: A Node.js application running on port 3000.

Step 1: Create Project Directories

Organize your projects in the /var/www directory.

# Create directories for the main site and blog
sudo mkdir -p /var/www/eknath.dev/html
sudo mkdir -p /var/www/blog.eknath.dev/html

# Set correct permissions
sudo chown -R $USER:$USER /var/www/eknath.dev
sudo chown -R $USER:$USER /var/www/blog.eknath.dev

Verify that the directories were created with the correct ownership.

ls -ld /var/www/eknath.dev/
ls -ld /var/www/blog.eknath.dev/

Now, place some placeholder files.

echo "<h1>Welcome to Eknath's Site</h1>" | sudo tee /var/www/eknath.dev/html/index.html
echo "<h1>Welcome to Eknath's Blog</h1>" | sudo tee /var/www/blog.eknath.dev/html/index.html

Step 2: Create Nginx Server Blocks

Now, we create a configuration file for each site in sites-available.

For the main domain (eknath.dev):

sudo nano /etc/nginx/sites-available/eknath.dev

Add the following server block:

server {
    listen 80;
    listen [::]:80;

    server_name eknath.dev www.eknath.dev;

    root /var/www/eknath.dev/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

For the blog subdomain (blog.eknath.dev):

sudo nano /etc/nginx/sites-available/blog.eknath.dev

Add this configuration:

server {
    listen 80;
    listen [::]:80;

    server_name blog.eknath.dev;

    root /var/www/blog.eknath.dev/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Step 3: Configure the Reverse Proxy for the API

For api.eknath.dev, we’ll proxy requests to our Node.js app, which we assume is running on http://127.0.0.1:3000.

Create the configuration file:

sudo nano /etc/nginx/sites-available/api.eknath.dev

Add the reverse proxy configuration:

server {
    listen 80;
    listen [::]:80;

    server_name api.eknath.dev;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Step 4: Enable the Sites and Test

Now, link these configurations into sites-enabled to activate them.

sudo ln -s /etc/nginx/sites-available/eknath.dev /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/blog.eknath.dev /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/api.eknath.dev /etc/nginx/sites-enabled/

Test the Nginx configuration for syntax errors:

sudo nginx -t

If it’s successful, restart Nginx to apply the changes:

sudo systemctl restart nginx

Check the status to ensure it restarted correctly.

sudo systemctl status nginx

After setting up your DNS records, you’ll be able to access each service through its unique subdomain.

5. Securing Your Sites with SSL (HTTPS)

We’ll use Let’s Encrypt, a free and automated Certificate Authority, and Certbot, a tool that makes managing SSL/TLS certificates effortless.

Step 1: Install Certbot

Certbot has a dedicated Nginx plugin that automates the process.

# Install Certbot and its Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

Step 2: Obtain and Install the SSL Certificates

With your server blocks already configured, running Certbot is incredibly simple.

# Run Certbot to get certificates for all configured domains
sudo certbot --nginx

Certbot will guide you through a few simple steps:

1. Enter your email address.
2. Agree to the Terms of Service.
3. Choose domains from the list Certbot finds.
4. Choose to redirect HTTP to HTTPS. This is highly recommended.

Step 3: Verify the New Configuration

Certbot automatically modifies your Nginx files to enable HTTPS. You can check the new configuration by running sudo nginx -t and then reloading Nginx with sudo systemctl reload nginx.

Step 4: Understanding Automatic Renewal

Let’s Encrypt certificates are valid for 90 days. The Certbot package automatically sets up a task to renew them. You can test the renewal process with a dry run:

sudo certbot renew --dry-run

If this command runs without errors, your auto-renewal is set up correctly.

Conclusion

You have now transformed a basic VPS into a sophisticated, multi-tenant hosting platform. By leveraging Nginx’s server blocks and reverse proxy capabilities, you can host and manage numerous projects, each on its own subdomain, from a single server. Happy hosting!