Your VPS server: first login over SSH

What you'll achieve

• log in to the server over SSH, from Windows, Mac or Linux;
• replace the password you received with your own;
• log in with an SSH key, without a password.

Before you start

• Access details. Log in to your NBT Account (https://nbt-host.com/cont, see NBT Account: how to log in and what you'll find). On the server's row you see the IP, the username and, with “Show password”, the password. We don't send you the password by email.
• A terminal. On Mac and Linux: the Terminal app. On Windows 10 and 11: PowerShell or Terminal, which already have the ssh command.
• The server's operating system. Ubuntu, Debian, AlmaLinux or Rocky, as you chose when ordering. The commands differ in places; we give both when needed.
• In the examples, 203.0.113.7 stands for your server's IP address.
• This guide is for Linux servers. On a Windows Server machine, you connect with Remote Desktop, not over SSH.

The steps

A. Log in for the first time

1. Open the terminal and type:

   ssh root@203.0.113.7

2. On the first connection, a message like “The authenticity of host … can't be established” appears, with the fingerprint of the server's key. Type yes and press Enter. Your computer remembers the fingerprint and warns you if it ever changes.
3. Type the password from your NBT Account. Nothing appears on screen while you type it, not even asterisks; that's normal. You can paste it (in PowerShell, right-click; in Terminal on a Mac, Cmd+V) and press Enter.
4. The server prompt appears, in the form root@nume-server:~#. You are on the server.

B. Change the root password

5. Type:

   passwd

6. Type a new, long password twice, generated by your password manager (see Strong passwords and two-factor authentication, everywhere). Again, what you type isn't shown.
7. The password in your NBT Account stays the old one: your NBT Account shows the password from the handover, not the one you changed. From now on, the only copy of the new password is with you.

C. Create an SSH key, on your computer

An SSH key is a pair of files: a private one, which stays only on your computer, and a public one, which you put on the server. It is much harder to crack than a password.

8. Open a new terminal, on your computer (not on the server) and type:

   ssh-keygen -t ed25519 -C "laptop-ana"

9. Press Enter to accept the suggested file location. When asked for a passphrase, set one: if you lose your laptop, the key can't be used without it.
10. Two files are created in the .ssh folder in your user folder: id_ed25519 (the private key, never give it to anyone) and id_ed25519.pub (the public key).

D. Put the public key on the server

11. On Mac and Linux:

    ssh-copy-id root@203.0.113.7

    Type the new root password. The command adds the public key to the server.

12. On Windows (PowerShell), where ssh-copy-id is missing:

    type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@203.0.113.7 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

13. Log out of the server (exit) and log in again with ssh root@203.0.113.7. If you get in without being asked for the server password (only the key's passphrase, if you set one), the key works.

Don't turn off password login yet: you do that in Your VPS server: a regular user and key-only SSH, once you have a regular user who logs in with a key.

What to do next

1. A regular user, with sudo, and key-only SSH: Your VPS server: a regular user and key-only SSH.
2. Updates and the firewall: Your VPS server: updates and the firewall.
3. Backups and monitoring: Your VPS server: backups and monitoring.

A server with a weak password gets found by bots within the first few hours. Do the first two steps on the same day.

If something doesn't work

• “Connection timed out”. Check the IP. If it's correct, your network may be blocking port 22 (some office networks do): try from your phone, as a hotspot.
• “Permission denied, please try again.” The password is wrong. Copy it again from your NBT Account, without spaces at either end. After many failed attempts, wait a few minutes.
• “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!” The server's fingerprint has changed: the server was reinstalled, or you are connecting to a different machine. If you know it was reinstalled, delete the old fingerprint with ssh-keygen -R 203.0.113.7 and connect again. If you don't know why, don't continue and write to us.
• You lost your new root password and don't have a key. We don't log in to the server and don't have your password. Write to us: we will tell you what can be done on your server, for example restoring from a backup, if you have automatic backups.