Server initialization checklist (2026 edition)

Another test machine arrived, so here is the current version of the initialization checklist, updated from last year's. Written so I can follow it mechanically at 2am.

Step 1: SSH hardening

Create a normal user with keys, confirm login works, only then disable root password login. Reversing the order is how you lock yourself out. Then in sshd_config: PasswordAuthentication no, PermitRootLogin prohibit-password, restart sshd.

Step 2: base packages and timezone

apt update && apt install -y curl git vim ufw fail2ban unattended-upgrades
timedatectl set-timezone Asia/Shanghai
ln -sf /usr/bin/vim /usr/bin/vi

Step 3: firewall

ufw default deny incoming, then allow per service. fail2ban's default policy for SSH is enough; I stopped writing custom jails years ago.

Step 4: kernel and sysctl

net.core.somaxconn and net.ipv4.tcp_congestion_control=bbr as usual; modern kernels have sensible defaults for nearly everything else. I stopped copying one-click tuning scripts after measuring how little they change.

Finally: keep a shell history of the whole session in the private repo. When the machine needs rebuilding, the history is the script.