Lesson 4 of 20 · Learn · 20 min
1.4 Set your server up safely
1. Update everything (on the server, as root)
apt update && apt upgrade -y
If it asks a question in a blue box, press Enter to keep the current choice. If Health later says A restart is needed to finish updates, run reboot (or use Controls → Restart) at a quiet time.
2. Your own user with sudo (on the server, as root; use your own name)
adduser kwesi usermod -aG sudo kwesi
adduser asks for a password (long, saved in your password manager) and some details you can leave empty by pressing Enter. From now on, log in as ssh kwesi@<your IP> and put sudo in front of commands that need root.
3. Log in with a key (on your laptop, in a new terminal)
ssh-keygen -t ed25519
Press Enter three times (default file, and an optional passphrase). Then copy the public key to the server:
- Mac and Linux:
ssh-copy-id kwesi@<your IP> - Windows (PowerShell):
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh kwesi@<your IP> "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"
Now ssh kwesi@<your IP> logs you in without a password.
What Lynk already set up for you
| Protection | What it does | Where you see it |
|---|---|---|
| Firewall | Only ports 22 (SSH), 80 and 443 (websites) are open | Health |
| Automatic security updates | Security fixes install by themselves | Health |
| Password-guessing protection | 5 wrong tries blocks that address for an hour | Health |
Golden rules
- Never share the private key (
id_ed25519, without.pub) or a server password, not even with Lynk. - Keep your old login open in one window while you test a new one in another.
- Don't paste commands you don't understand.
- Before a big change, Backups → Take a backup now.
Sign in to save your progress and earn the certificate.