Linux VPS: Essential Commands to Get Started

Tutorials VPS
,
1

Linux VPS: Essential Commands to Get Started
Linux VPS: Essential Commands to Get Started1200×800 230 KB

Linux VPS: Essential Commands to Get Started

You have just received a BoxToPlay Linux VPS and a public IP address, but you have never used Linux before. Where do you type commands? How do you create folders, edit a configuration file, upload an archive from Windows, install a tool, or keep an application running after you close the terminal?

This BoxToPlay guide starts from zero. Its purpose is not to teach every part of Linux. It gives you the practical foundations required to host a website, a bot, a game service, an API, a database, or another application on a Debian or Ubuntu VPS.

Every command is explained before you move to the next task. Whenever Linux has a useful Windows equivalent, a Windows reference point helps you connect the new idea to something familiar.

Important: examples use the documentation-only IP address 203.0.113.10, the account root, and the folder /opt/my-service. Replace them with your own values. Never paste an unknown command with administrator privileges without understanding it.

Code blocks marked bash are typed in the VPS SSH terminal, so inside PuTTY, Termix, or another SSH client that is already connected. Code blocks marked powershell are typed on your Windows PC.

If you are starting from zero, follow this order:

  1. Open an SSH connection from Windows.
  2. Check the connected account and Linux version.
  3. Update the system.
  4. Understand root, sudo, and optional user creation.
  5. Learn how to navigate, copy, and edit files.
  6. Install useful tools.
  7. Run your application as a service, then check logs, firewall rules, and backups.

What changes between a Windows PC and a Linux VPS?

A Windows computer is usually managed through windows, menus, File Explorer, Task Manager, and graphical installers. A Linux server is commonly administered remotely through a terminal. The screen is different, but most concepts have a direct equivalent.

Familiar action on Windows Usual Linux server equivalent
Windows Terminal or PowerShell A local terminal used to start an SSH connection
Remote Desktop SSH, a secure text connection
File Explorer ls, cd, cp, mv, rm, or an SFTP client such as WinSCP
Notepad nano in the terminal
Windows Update apt update followed by apt upgrade
WinGet or an installer apt install package-name
Run as administrator and UAC sudo
Task Manager htop, ps, free, and df
Windows Services systemd and systemctl
Event Viewer journalctl
Windows Defender Firewall ufw, nftables, or iptables
7-Zip or Extract All unzip, tar, gzip, and xz
Copying files over the network SFTP, SCP, or rsync

Linux file and command names are usually case-sensitive. Config, config, and CONFIG can therefore be three different names.

Choose your tools on Windows

You only need a few programs to begin. What matters is having two capabilities: opening the VPS SSH terminal and transferring files over SFTP. Termix groups both in one application. PuTTY with WinSCP remains the classic pair if you prefer to separate terminal access and file management.

PuTTY: a classic graphical SSH client

PuTTY provides a connection window, saved sessions, and companion tools such as PuTTYgen for SSH keys and PSCP for file transfers.

It remains useful when you prefer a dedicated graphical application. Do not install several SSH clients just because they are listed here: choose the one you understand best.

WinSCP: a File Explorer-like view of the VPS

WinSCP displays the local Windows files on one side and the VPS files on the other. It uses SFTP over the same secure connection as SSH.

WinSCP is especially helpful if you chose PuTTY for the terminal and want a separate tool for uploads, downloads, backups, or small file edits.

Termix: SSH and files in one interface

Termix combines SSH terminal access, SFTP-compatible remote file management, tunnels, statistics, and server organization.

Termix is therefore the simplest default recommendation if you want one place for the terminal, file transfers, and saved connections. PuTTY with WinSCP remains a classic alternative if you prefer two separate, well-known, lightweight tools.

Before starting: how to read a Linux command

A command normally contains three kinds of elements:

command option argument
  • The command is the program to run, such as ls.
  • An option changes its behavior. It often begins with - or --, such as -h or --help.
  • An argument identifies what the command should use, such as the path /opt/my-service.

Consider this example:

ls -lah /opt
  • ls lists files and folders.
  • -l requests a detailed list.
  • -a includes hidden entries whose names begin with a dot.
  • -h displays sizes in readable units such as KB, MB, or GB.
  • /opt is the folder being inspected.

Several symbols appear often:

  • ~ represents the current user’s personal folder, such as /root.
  • . represents the current folder.
  • .. represents the parent folder.
  • / is the root of the entire Linux file system, not a drive letter.
  • $USER is a variable containing the current account name.
  • * is a wildcard representing several matching names.
  • | sends the output of one command into another command.
  • Ctrl+C interrupts a command that is currently running.

Windows reference point: a PowerShell command such as Get-ChildItem -Force C:\Temp follows the same basic idea: command, option, and target.

To see the built-in manual for a command:

man ls
  • man opens a manual page.
  • ls is the command whose documentation you want.
  • Use the arrow keys to move, / to search, and q to quit.

If a command supports it, a shorter help page is often available:

ls --help
  • --help asks ls to print its options without opening the full manual.

Connect to the VPS with your SSH client

After your BoxToPlay VPS is delivered, your control panel normally shows:

  • the public IP address.
  • an SSH port, usually 22.
  • the initial SSH user root.
  • either a password or an SSH private key.

Open the SSH client you chose, for example PuTTY or Termix, and create a new connection. Fill in:

  • Host: 203.0.113.10.
  • Port: 22 or the SSH port shown in your BoxToPlay control panel.
  • Protocol: SSH.
  • User name: root.
  • Authentication: the initial password or the private key.

The root account is the Linux superuser. On a BoxToPlay VPS, it is the normal first administration account. It can change the whole system, so read commands before pasting them.

In PuTTY, enter the address in Host Name, check the Port, keep the connection type set to SSH, then save the session if you want to reuse it later.

In Termix, create a server or connection, then enter the host, port, user name, and authentication method.

In WinSCP, choose SFTP, enter the same details, then connect to manage files. WinSCP does not replace a full terminal: keep PuTTY or Termix available for administration commands.

The first connection displays the server fingerprint. Compare it with the value shown by BoxToPlay when one is available, then accept it only if the destination is correct. This fingerprint helps detect a server impersonation.

When a password is requested, no character appears while you type. This is normal: Linux does not display dots or asterisks for terminal passwords.

Windows reference point: SSH serves a purpose similar to Remote Desktop, but it opens a command-line session instead of a graphical desktop.

Identify the system before changing it

Once connected, run:

whoami
hostname
cat /etc/os-release
uname -r
  • whoami prints the connected account name. The same command also exists on Windows.
  • hostname prints the machine name. It also exists on Windows.
  • cat prints a text file. /etc/os-release describes the Linux distribution and its version.
  • uname -r prints the Linux kernel version. The kernel is the central part of the operating system.

On a fresh Ubuntu 24.04 VPS, the output looked like this:

root
vps-demo
PRETTY_NAME="Ubuntu 24.04.4 LTS"
6.8.0-136-generic

The first line confirms the account being used. The second line is the machine name. The last two lines identify the Linux distribution and kernel.

Windows reference point: cat /etc/os-release and uname -r provide information similar to PowerShell Get-ComputerInfo or the winver window.

Understand sudo, apt, and apt-get

Debian and Ubuntu distribute software as packages. A package contains a program, its version, and the information required to install it. Packages come from repositories, which are software catalogs configured on the server.

apt is the package manager intended for interactive terminal use. It can search, install, update, and remove software.

You will also encounter apt-get, with a hyphen. Both tools use the same repositories and install the same packages:

  • apt has friendlier output for a person using a terminal.
  • apt-get has stable output and behavior that is commonly preferred in automation scripts.
With apt Common older syntax with apt-get Result
apt update apt-get update Refresh the package catalog
apt install htop apt-get install htop Install the htop package

This guide uses apt. You do not need to repeat the same action with apt-get.

sudo means “run the next command with administrator privileges.” It is comparable to Run as administrator and the UAC confirmation on Windows.

Windows reference point: apt combines ideas from Windows Update and WinGet. Linux repositories provide both system updates and many applications.

Some minimal Debian installations do not include sudo yet. This case only applies when you are already connected as root. If the terminal displays sudo: command not found, run:

apt update
apt install sudo
  • apt update refreshes the package catalog without sudo because root already has administrator privileges.
  • apt install sudo downloads and installs the package that provides the sudo command.

Do not run these lines from a normal account without administrator privileges: Linux will refuse them.

Install the first updates safely

If whoami displayed root, you already have administrator privileges and can remove sudo from the commands in this section. With a normal administrator account, keep it.

First refresh the software catalog:

sudo apt update
  • sudo requests administrator privileges.
  • apt opens the package manager.
  • update downloads the current list of packages and versions.

This command does not update any installed program yet. It only searches for available versions, like the first phase of Windows Update.

Now review and install the available updates:

sudo apt upgrade
  • upgrade compares installed packages with the refreshed catalog.
  • A summary is displayed before any change.
  • Type Y, then press Enter, if the proposed changes are acceptable.

Later, you may see this version:

sudo apt upgrade -y
  • -y automatically answers yes to confirmation questions.
  • The option is convenient for known operations, but it removes the opportunity to review the summary.

For your first update, prefer the version without -y.

Windows reference point: apt update searches for updates. apt upgrade downloads and installs them.

Set the time zone and verify clock synchronization

Correct time is essential for understanding logs, running scheduled tasks at the expected moment, and validating HTTPS certificates. Start by displaying the current configuration:

timedatectl status
  • timedatectl reads and configures the system clock.
  • status displays local time, Universal Time in UTC, the time zone, and network synchronization status.
  • sudo is not required because this command does not change anything.

Example output from a fresh Ubuntu 24.04 VPS:

Local time: Sun 2026-08-02 00:59:56 UTC
Universal time: Sun 2026-08-02 00:59:56 UTC
Time zone: Etc/UTC (UTC, +0000)
System clock synchronized: yes
NTP service: active

Here, System clock synchronized: yes means that the clock is synchronized, and NTP service: active shows that network time synchronization is working. Depending on the Debian or Ubuntu version, synchronization may be handled by chrony or systemd-timesyncd. Do not install another time synchronization service before identifying the one already in use.

Display the available time zones when you do not know the exact identifier:

timedatectl list-timezones
  • list-timezones displays recognized identifiers such as America/New_York.
  • Use the arrow keys to browse and press q to quit if the list opens in a pager.

Set the time zone for your region:

sudo timedatectl set-timezone America/New_York
  • sudo authorizes a system setting change.
  • set-timezone changes the time zone used to display dates.
  • America/New_York is the example identifier to replace for another region.

Run timedatectl status again to verify the result.

Windows reference point: these commands correspond to the Windows Date & time settings. The time zone controls how dates are displayed, while NTP synchronization is comparable to “Set time automatically.”

Check automatic security updates

Manual checks with apt update and apt upgrade remain useful, but an always-connected server should also receive security fixes regularly. Ubuntu normally installs the unattended-upgrades package by default. A Debian or minimal image may not include or enable it.

First check whether the package is installed:

apt policy unattended-upgrades
  • apt policy displays the installed and available version of a package.
  • unattended-upgrades is the package that can automatically install approved updates.
  • Installed: (none) means that the package is not installed.

Inspect the APT schedules known to systemd:

systemctl list-timers apt-daily.timer apt-daily-upgrade.timer --no-pager
  • systemctl list-timers displays tasks triggered on a schedule.
  • apt-daily.timer periodically refreshes package information.
  • apt-daily-upgrade.timer starts automatic update processing.
  • --no-pager prints the result directly in the terminal.

If the package is missing and you want this mechanism on Debian or Ubuntu:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
  • apt install unattended-upgrades installs the automatic update mechanism.
  • dpkg-reconfigure reopens the configuration assistant for the installed package.
  • Answer yes when asked whether automatic security updates should be enabled.

This mechanism does not automatically update every manually downloaded application or every third-party repository. Continue to monitor your service, its backups, and its own security announcements.

Some kernel or core component updates require a restart. Do not restart in the middle of an operation. Check your backups, plan the interruption, and only when a restart is requested use:

sudo reboot
  • sudo requests administrator privileges.
  • reboot stops services and restarts the VPS.
  • The SSH connection closes immediately and should become available again after boot.

Windows reference point: unattended-upgrades is comparable to the automatic installation of security fixes by Windows Update. sudo reboot corresponds to Restart, not Shut down.

Create a Linux user (optional)

On a BoxToPlay VPS, administration is generally done with the root account. Creating another user is not required to get started. It is useful when you want a separate login, an account for another person, or a simple example of Linux users.

Create a regular user:

sudo adduser newuser
id newuser
  • sudo adduser newuser creates the user, asks for its password, and creates /home/newuser with administrator privileges.
  • id newuser prints the user’s identifiers and groups.

By default, this user is not an administrator. If you want it to run commands with sudo, explicitly add it to the sudo group:

sudo usermod -aG sudo newuser
id newuser
  • sudo usermod changes an existing user with administrator privileges.
  • -a means append without removing existing group memberships.
  • -G sudo adds the user to the group named sudo.

Windows reference point: creating the user alone is similar to creating a standard local account. Adding it to the sudo group gives it the ability to elevate selected commands, like a Windows account placed in the Administrators group.

If you test this new account, keep your root session open, open a second connection as newuser, then run:

sudo whoami
  • sudo requests elevated privileges and may ask for the newuser password.
  • whoami then prints the identity used for the command.
  • The expected result is root.

Do not close your original root session while changing SSH or firewall settings. It remains your recovery path if a new connection fails.

Replace password authentication with an SSH key

An SSH key uses a pair of files:

  • the private key remains on your Windows computer and must never be shared.
  • the public key is copied to the VPS and can safely identify your computer.

On Windows, generate a key:

ssh-keygen -t ed25519 -a 100
  • ssh-keygen creates and manages SSH keys.
  • -t ed25519 selects the modern Ed25519 key type.
  • -a 100 increases the work required to test each passphrase guess if the private key is stolen.
  • Press Enter to accept the proposed location, then choose a strong passphrase.

Copy the public key from Windows to the root account:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys; chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys"
  • Get-Content reads the public key file on Windows.
  • $env:USERPROFILE represents your Windows profile folder.
  • | sends the public key to the ssh command.
  • umask 077 makes newly created files private to the remote account.
  • mkdir -p ~/.ssh creates the remote .ssh folder if it does not exist.
  • cat >> ~/.ssh/authorized_keys appends the key instead of erasing existing authorized keys.

Termix and the Windows OpenSSH client can use the private key created by ssh-keygen directly. For PuTTY, open PuTTYgen, choose Conversions > Import key, select the OpenSSH private key, and save it as a .ppk file. WinSCP can also use that .ppk file for authentication.

Create another root connection in Termix using the OpenSSH key, or in PuTTY using the .ppk file created with PuTTYgen. Your client may ask for the key passphrase, but it should no longer ask for the Linux account password.

Only after this test succeeds should you consider changing SSH authentication or disabling password login. Always preserve the BoxToPlay rescue console or another recovery method before changing SSH settings.

You can continue administering the VPS as root. If you created an additional user, configure its SSH key separately in that account’s own ~/.ssh/authorized_keys file.

Windows reference point: the private key is similar to a personal credential stored on your computer, while the public key acts like an allowed identity registered on the server.

Navigate through folders

Display your current location:

pwd
  • pwd means print working directory.
  • It prints the full path of the folder in which commands currently operate.

List its contents:

ls -lah
  • ls lists entries.
  • -l adds permissions, owner, size, and date.
  • -a includes hidden entries.
  • -h uses readable sizes.

Move to another folder:

cd /opt
  • cd means change directory.
  • /opt is commonly used for manually installed applications.

Return to your personal folder:

cd ~
  • ~ expands to the current user’s home folder.

Move to the parent folder:

cd ..
  • .. refers to one level above the current folder.

Windows reference point: pwd, ls, and cd correspond approximately to PowerShell Get-Location, Get-ChildItem, and Set-Location. Windows paths use drive letters and backslashes, while Linux paths begin at / and use forward slashes.

Create, copy, move, and delete files

Create a service folder and enter it:

sudo mkdir -p /opt/my-service
sudo chown "$USER":"$(id -gn)" /opt/my-service
cd /opt/my-service
  • mkdir creates a folder.
  • -p also creates missing parent folders and avoids an error if the folder already exists.
  • chown changes ownership.
  • "$USER":"$(id -gn)" assigns the current user and its primary group.
  • cd enters the folder.

Create an empty file:

touch config.txt
  • touch creates config.txt if it does not exist.
  • If it already exists, its modification date is updated without changing its contents.

Copy the file:

cp config.txt config.backup.txt
  • cp copies the first path to the second path.
  • The original file remains in place.

Rename or move the copy:

mv config.backup.txt old-config.txt
  • mv moves an item.
  • When both paths are in the same folder, the visible result is a rename.

Delete the renamed file:

rm old-config.txt
  • rm removes a file immediately.
  • A normal terminal session has no Recycle Bin.

Delete a folder and everything inside it only when you have verified the exact path:

rm -r folder-to-delete
  • -r means recursive and allows rm to descend through a folder.
  • This can remove many files, so inspect the folder with ls first.
  • Never copy a destructive command without replacing and checking its example path.

Windows reference point: mkdir, cp, mv, and rm correspond to New folder, Copy, Cut or Rename, and Delete. The major difference is that command-line deletion is normally immediate.

Edit a text file with Nano

Install Nano if it is missing:

sudo apt install nano
  • sudo requests administrator privileges.
  • apt install downloads and installs a package.
  • nano is the package name and the command that will become available.

Open a file:

nano /opt/my-service/config.txt
  • nano starts the editor.
  • The path identifies the file to open or create.

In Nano:

  • type normally to edit.
  • press Ctrl+O, then Enter, to save.
  • press Ctrl+X to leave.
  • press Ctrl+W to search.
  • the ^ symbol displayed by Nano means the Ctrl key.

Windows reference point: Nano plays the role of a simple Notepad inside the terminal.

For a system file, include sudo:

sudo nano /etc/hosts
  • sudo is required because /etc/hosts belongs to the system.
  • /etc contains many system and application configuration files.

Create a backup before changing an important file:

sudo cp /etc/hosts /etc/hosts.backup
  • cp duplicates the original file.
  • The .backup suffix is only a readable naming convention.

Upload files and archives from Windows

SFTP with WinSCP

Create a WinSCP connection with:

  • protocol: SFTP.
  • host: your VPS IP address.
  • port: your SSH port.
  • user: root.
  • authentication: your password or private key.

Drag files into /root/uploads first. This keeps the upload in the root home folder before you move it to the final application path.

Prepare that destination on the VPS:

mkdir -p ~/uploads
ls -ld ~/uploads
  • mkdir -p creates the uploads folder in your home directory.
  • ls -ld displays the folder itself, including its owner and permissions.

SCP from PowerShell

Upload one archive:

scp "$env:USERPROFILE\Downloads\app.zip" [email protected]:/root/uploads/
  • scp securely copies files through SSH.
  • The Windows path before the space is the local source.
  • [email protected]: identifies the remote account and server.
  • /root/uploads/ is the destination.

With a custom SSH port:

scp -P 2222 "$env:USERPROFILE\Downloads\app.zip" [email protected]:/root/uploads/
  • SCP uses uppercase -P for its port option.
  • This differs from SSH, which uses lowercase -p.

Download a file from the VPS:

scp [email protected]:/var/log/my-service/app.log "$env:USERPROFILE\Downloads\"
  • The remote path appears first because it is the source.
  • The Windows Downloads folder appears second because it is the destination.

Inspect and extract archives

Install common archive tools:

sudo apt install unzip zip p7zip-full xz-utils
  • apt install can install several packages separated by spaces.
  • unzip extracts .zip archives.
  • zip creates .zip archives.
  • p7zip-full adds 7-Zip format support.
  • xz-utils handles .xz compression.

Inspect an archive before extracting it:

unzip -l ~/uploads/app.zip
  • unzip handles the ZIP file.
  • -l lists its contents without extracting them.
  • Inspecting names first helps detect an unexpected layout or suspicious paths.

Create an isolated destination in your home folder and extract the ZIP there first:

mkdir -p ~/imports
unzip ~/uploads/app.zip -d ~/imports
ls -la ~/imports/my-service
  • mkdir -p prepares a dedicated staging folder.
  • unzip reads the uploaded archive.
  • -d selects the extraction directory.
  • ls -la lets you review the extracted files before moving them into the final application folder.

List a .tar.gz archive:

tar -tzf ~/uploads/archive.tar.gz
  • tar manages tar archives.
  • -t lists contents.
  • -z uses gzip compression.
  • -f means the next argument is the archive file.

Example output for a small archive:

my-service/
my-service/config/
my-service/config/config.yml

If you see absolute paths such as /etc/..., paths containing ../, or unexpected files, stop before extracting and verify the archive source.

Extract it into the same isolated folder:

mkdir -p ~/imports
tar -xzf ~/uploads/archive.tar.gz -C ~/imports
ls -la ~/imports/my-service
  • -x extracts.
  • -z decompresses gzip.
  • -f selects the archive.
  • -C changes to the destination before extracting.
  • mkdir -p is repeated here so the tar example also works if you did not extract a ZIP first.
  • Adjust ~/imports/my-service if the archive contains a different top-level folder.

After checking the extracted folder, copy its content to the final service path:

sudo mkdir -p /opt/my-service/releases/new
sudo rsync -a ~/imports/my-service/ /opt/my-service/releases/new/
  • sudo mkdir -p creates the final system folder if needed.
  • rsync -a copies the extracted content while preserving common file metadata.

Windows reference point: these commands perform the same job as Extract All or 7-Zip. On a server, listing the contents first is particularly important because an archive may come from an external source.

Install a practical starter toolbox

Install a small set of widely useful tools:

sudo apt install curl wget git htop tree jq rsync ca-certificates

Each package has a distinct purpose:

  • curl sends web requests and is useful for testing an HTTP endpoint.
  • wget downloads a file from a URL.
  • git retrieves and updates source repositories.
  • htop displays processes, CPU, and memory interactively.
  • tree displays folders as a tree.
  • jq reads and filters JSON.
  • rsync synchronizes files efficiently.
  • ca-certificates provides the trusted certificate authorities used by HTTPS connections.

Windows reference point: WinGet can install applications on Windows. On Debian and Ubuntu, apt installs these tools and their dependencies from configured repositories.

Do not install a command merely because an online guide mentions it. Check the official documentation, package source, and purpose first.

Understand useful hosting folders

Start by exploring without changing files:

pwd
ls -lah
cd /opt
ls -lah
cd ~
  • pwd means « print working directory » and displays the path of the current folder. The PowerShell equivalent is Get-Location.
  • ls -lah displays detailed contents, including hidden entries, with readable sizes. The PowerShell equivalent is Get-ChildItem -Force.
  • cd /opt moves your terminal into /opt. The PowerShell equivalent is Set-Location.
  • The second ls -lah displays the content of /opt.
  • cd ~ returns to your home folder.

The main locations are:

  • /root: home folder of the root account, similar to C:\Users\Administrator.
  • /home/user: home folder of a user created with adduser, similar to C:\Users\User.
  • /opt/my-service: common location for a standalone application, similar to C:\Program Files\MyService.
  • /etc/my-service: system configuration, with no single Windows equivalent.
  • /var/lib/my-service: persistent application data, similar to C:\ProgramData\MyService.
  • /var/log: many system and application logs, similar to Event Viewer and Windows log folders.
  • /var/www: files for a classic web server, similar to C:\inetpub\wwwroot with IIS.
  • /tmp: temporary files, similar to %TEMP%.

A path starting with / is absolute: it starts at the system root. A path without a leading / is relative to the folder shown by pwd.

Understand users, groups, and permissions

Linux does not give every account the same access. Each file and folder has an owner, a group, and separate permissions for the owner, the group, and everyone else. This prevents a service, script, or local user from reading or changing files that do not belong to it.

Inspect a folder and a file:

ls -ld /opt/my-service
ls -l /opt/my-service/config/config.yml

Example output:

drwxr-x--- 3 myservice myservice 4096 Aug  2 02:34 /opt/my-service
-rw-r----- 1 myservice myservice   17 Aug  2 02:34 /opt/my-service/config/config.yml

The beginning of each line shows the type and permissions:

  • d means directory, - means regular file.
  • r means read.
  • w means write.
  • x means execute for a file, or enter/traverse for a directory.
  • The first three permissions apply to the owner.
  • The next three apply to the group.
  • The last three apply to everyone else.

In the example, /opt/my-service can be read and entered by the owner and group, but not by other users. The config.yml file can be read and changed by its owner, read by the group, and hidden from everyone else.

Create a service account that cannot open an interactive session, then assign the full folder to it:

sudo useradd --system --user-group --home-dir /opt/my-service --shell /usr/sbin/nologin myservice
sudo chown -R myservice:myservice /opt/my-service
  • useradd creates an account.
  • --system marks it as a service account.
  • --user-group also creates a myservice group.
  • --home-dir /opt/my-service assigns the application folder as its home.
  • --shell /usr/sbin/nologin prevents normal terminal login.
  • chown -R changes the owner and group recursively.

Protect a configuration file that contains a secret:

sudo chmod 640 /opt/my-service/config/config.yml
  • 6 gives the owner read and write access.
  • 4 gives the group read-only access.
  • 0 gives everyone else no access.

To change permissions for a whole directory that already contains files, use a recursive command:

sudo chmod -R u=rwX,g=rX,o= /opt/my-service
  • chmod -R applies the permissions to all existing content.
  • u=rwX gives the owner read and write access, plus directory access.
  • g=rX gives the group read access and directory traversal.
  • o= removes all access for everyone else.
  • The uppercase X adds execute permission only to directories and files that are already executable, which avoids making every file executable by mistake.

This is useful after extracting an archive, uploading files with SFTP, or restoring a backup, when ownership is wrong or permissions are too open.

Never use chmod -R 777 as a general fix. It gives every local user permission to read, change, and execute the content. It hides the real problem and weakens security.

Windows reference point: owner, group, and mode bits serve a role comparable to file ownership and NTFS access-control entries, but Linux often expresses common permissions with short symbols or numbers.

Monitor CPU, memory, disk, and processes

Open the interactive process view:

htop
  • htop displays CPU, memory, and running processes.
  • Use the arrow keys to navigate and F10 or q to quit.

Windows reference point: htop is the closest equivalent to Task Manager.

Check memory:

free -h
  • free reports RAM and swap usage.
  • -h uses readable units.
  • On Linux, memory used for cache can be reclaimed, so the available value is often more useful than free.

Check disk space:

df -h
  • df reports free and used space for mounted file systems.
  • -h uses GB and MB.
  • Pay attention to the row mounted on /.

Example output for free -h and df -h /:

Mem:   15Gi  554Mi   14Gi
Swap: 7.8Gi     0B  7.8Gi
/dev/sda2  99G  12G  83G  12% /

Here the main file system mounted on / is 12% used, and the memory overview shows that most RAM is still available.

Measure one folder:

du -sh /opt/my-service
  • du measures disk usage.
  • -s prints one total.
  • -h uses readable units.
  • The path selects the folder to measure.

List processes matching a name:

ps aux | grep myservice
  • ps aux lists running processes with their owners and resource usage.
  • | passes that list to the next command.
  • grep myservice keeps lines containing myservice.
  • The grep command itself may also appear in the result.

Windows reference point: free, df, du, and ps correspond broadly to the Performance tab, Storage settings, folder properties, and the Details tab in Task Manager.

Check listening ports and test a local service

Display listening TCP and UDP sockets:

sudo ss -tulpn
  • ss displays network sockets.
  • -t includes TCP.
  • -u includes UDP.
  • -l keeps listening sockets.
  • -p displays the associated process when permissions allow it.
  • -n keeps addresses and ports numeric.

Useful example lines:

tcp LISTEN 0 4096 0.0.0.0:22  0.0.0.0:* users:(("sshd"))
tcp LISTEN 0 511  0.0.0.0:80  0.0.0.0:* users:(("nginx"))

0.0.0.0:22 means SSH is listening on all IPv4 interfaces. 127.0.0.1:8080 would mean that the service only listens from the VPS itself.

Check a specific port:

sudo ss -tulpn | grep ':8080'
  • The first command creates the socket list.
  • | passes it to grep.
  • grep ':8080' keeps rows containing port 8080.

Test a web service from the VPS itself:

curl -I http://127.0.0.1:8080
  • curl sends the HTTP request.
  • -I requests response headers only.
  • 127.0.0.1 means this same machine.
  • :8080 selects port 8080.

A local response such as HTTP/1.1 200 OK means the application answers from the VPS itself. If the same service is unreachable from the internet, check the listening address, Linux firewall, BoxToPlay-side network rules, and reverse proxy.

Windows reference point: these checks correspond to Get-NetTCPConnection and Invoke-WebRequest in PowerShell.

A process listening locally is not automatically reachable from the internet. The application address, Linux firewall, BoxToPlay-side network rules, NAT, and reverse proxy can all affect access.

Keep an application running with systemd

Starting an application directly in SSH often ties it to the terminal. systemd is the service manager used by most current Debian and Ubuntu servers. It can start an application at boot, restart it after a failure, and collect logs.

In this example, the application provides /opt/my-service/start.sh. Always adapt this path to the software documentation.

Make the startup script executable and assign the service files to the service account:

sudo chmod +x /opt/my-service/start.sh
sudo chown -R myservice:myservice /opt/my-service
  • chmod +x adds permission to execute the script.
  • chown -R recursively assigns the application to the myservice account.

Create the service definition:

sudo nano /etc/systemd/system/myservice.service
  • sudo is required to write under /etc.
  • nano opens the editor.
  • Files ending in .service define systemd services.

Example:

[Unit]
Description=My hosted service
After=network-online.target

[Service]
Type=simple
User=myservice
Group=myservice
WorkingDirectory=/opt/my-service
ExecStart=/opt/my-service/start.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target
  • [Unit] describes the service and its startup dependencies.
  • After=network-online.target places it after the network-online target.
  • [Service] defines how the process runs.
  • User and Group avoid running it as root.
  • WorkingDirectory sets the current folder.
  • ExecStart is the exact executable and arguments. It is not an unrestricted shell line.
  • Restart=on-failure restarts the process after an unexpected failure.
  • [Install] defines how the service is attached to normal system startup.

Tell systemd to reread its files:

sudo systemctl daemon-reload
  • systemctl manages systemd.
  • daemon-reload reloads service definitions without restarting the whole VPS.

Enable and start the service:

sudo systemctl enable --now myservice
  • enable configures automatic startup at boot.
  • --now also starts it immediately.
  • myservice refers to myservice.service.

Check its state:

sudo systemctl status myservice
  • status shows whether the service is active and includes recent log lines.
  • Press q if the display opens in a pager.

Restart after a configuration change:

sudo systemctl restart myservice
  • restart stops and starts the service.
  • Use it only after saving and, when possible, validating the configuration.

Windows reference point: systemd services correspond to Windows Services. systemctl serves a role similar to the Services console or sc.exe.

Read logs with journalctl

Display the service log:

sudo journalctl -u myservice
  • journalctl reads logs collected by systemd.
  • -u myservice filters one unit.

Show the latest lines and continue following new entries:

sudo journalctl -u myservice -n 100 -f
  • -n 100 starts with the latest 100 lines.
  • -f follows new lines in real time.
  • Press Ctrl+C to stop following without stopping the service.

Show logs since the current boot:

sudo journalctl -u myservice -b
  • -b limits the result to the current system boot.

Windows reference point: journalctl fills a role similar to Event Viewer, while -f resembles watching a log file update live.

Configure a firewall without locking yourself out

Ubuntu commonly uses UFW as a simpler interface to the underlying firewall. Debian may use nftables directly or may not have UFW installed. Use one firewall management method at a time so that rules remain understandable.

Install UFW only when you deliberately choose it:

sudo apt install ufw
  • apt install installs the firewall management tool.
  • Installing UFW does not automatically enable it.

Display its current state before adding or enabling anything:

sudo ufw status verbose
  • ufw manages the firewall.
  • status reports whether it is active or inactive.
  • verbose also displays default policies and more detail.
  • This command does not change any rule.

On a server where UFW is not active yet, you may see:

Status: inactive

This means the tool is present, but this firewall is not currently enforcing rules.

Check that the predefined SSH profile exists:

sudo ufw app list
  • app list displays the application profiles registered with UFW.
  • Confirm that OpenSSH appears before using that profile name.

Allow SSH before the first activation:

sudo ufw allow OpenSSH
  • ufw allow adds an inbound allow rule.
  • OpenSSH normally covers TCP port 22 and keeps administrative SSH access available.
  • This rule does not open your application’s port.

Allow a custom SSH port when required:

sudo ufw allow 2222/tcp
  • 2222 is the example port to replace.
  • /tcp limits the rule to the TCP protocol used by SSH.

If the first status was inactive, activate UFW only after preparing the SSH rule:

sudo ufw enable
  • enable activates the firewall and its prepared rules.
  • If UFW was already active, new rules apply immediately and this command is unnecessary.
  • Keep the existing SSH session open while you test a second connection.

Inspect the resulting rules:

sudo ufw status numbered
  • status numbered lists active rules with numbers that can later be used to manage them.

Open normal web ports only when the VPS hosts a public website:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
  • Port 80/tcp is used for HTTP.
  • Port 443/tcp is used for HTTPS.

Open an application port such as 8080/tcp only when you deliberately want that application to be directly reachable from the internet. For a web application behind Nginx or Apache, keep the application on 127.0.0.1:8080 and open only the public proxy ports.

Windows reference point: UFW is comparable to Windows Defender Firewall rules. BoxToPlay-side network rules, when configured, add another layer much like a network firewall outside the computer.

If the system image or the delivered VPS configuration already manages nftables or iptables, do not activate UFW on top of it. You can inspect the existing configuration without changing it:

sudo nft list ruleset
sudo iptables -S
  • nft list ruleset displays all rules currently known to nftables.
  • iptables -S displays the current iptables rules as commands.
  • Both commands are read-only. Follow the distribution method or the BoxToPlay documentation that owns those rules.

Always preserve SSH access and a recovery console.

Add a domain name, reverse proxy, and HTTPS

A web application often listens only on 127.0.0.1:8080. A reverse proxy such as Nginx receives public requests on ports 80 and 443, then forwards them to the internal application.

If the application does not already include reliable authentication, do not expose it directly to the whole internet. Add a dedicated protection layer, such as Nginx Basic Auth, an IP restriction, or private access.

The usual sequence is:

  1. Create the DNS record for your domain and point it to the VPS IP.
  2. Keep the application on a local port when possible.
  3. Configure Nginx for the domain.
  4. Test the configuration.
  5. Obtain an HTTPS certificate.

Install Nginx:

sudo apt install nginx
  • apt install installs Nginx and its systemd service.
  • The package normally starts the web server automatically.

Create a virtual host file:

sudo nano /etc/nginx/sites-available/example.com
  • The file name usually matches the domain for readability.
  • sites-available stores configurations that can be enabled.

Example:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
  • listen 80 accepts HTTP connections.
  • server_name selects requests for the domain.
  • location / applies to all paths.
  • proxy_pass forwards requests to the local application.
  • The forwarded headers help the application know the original visitor address and protocol.

Enable the site:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
  • ln creates a link.
  • -s creates a symbolic link rather than a second copy.
  • Nginx reads enabled site links from sites-enabled.

Test the configuration:

sudo nginx -t
  • nginx runs the Nginx program.
  • -t checks configuration syntax without applying it.

A healthy result looks like this:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload Nginx only after a successful test:

sudo systemctl reload nginx
  • reload asks Nginx to reread its configuration while keeping the service available.

To generate an HTTPS certificate on Debian or Ubuntu with Nginx, install Certbot and run the Nginx assistant:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com
  • python3-certbot-nginx lets Certbot read and adapt the Nginx configuration.
  • certbot --nginx requests the certificate and can add the HTTPS configuration automatically.
  • Replace example.com with your real domain and follow the questions shown by Certbot.

Windows reference point: Nginx as a reverse proxy is comparable to using IIS with reverse-proxy rules and a TLS certificate.

Back up before an update

A backup is useful only if it contains the required data and can be restored.

The example below backs up only /opt/my-service. If your application uses MySQL, MariaDB, PostgreSQL, or another database, also create a dedicated database export.

Create a compressed archive and make it readable only by your account:

backup=~/backups/my-service-$(date +%F-%H%M).tar.gz
mkdir -p ~/backups
sudo tar -czf "$backup" -C /opt my-service
sudo chown "$USER":"$(id -gn)" "$backup"
chmod 600 "$backup"
tar -tzf "$backup" | head
  • backup=... stores the archive path once so the following commands reuse the same file.
  • mkdir -p ~/backups creates the backup folder in your home directory.
  • tar -czf creates (c) a gzip-compressed (z) archive in the selected file (f).
  • $(date +%F-%H%M) inserts the current date and time in the file name.
  • -C /opt my-service tells tar to switch to /opt and archive the my-service folder.
  • chown returns the archive to the connected account so it can be downloaded.
  • chmod 600 restricts archive access to its owner because backups can contain secrets.
  • tar -tzf lists the archive content to confirm it can be read.

Example output:

my-service/
my-service/config/
my-service/config/config.yml

This does not prove that the full restore will work, but it already catches an unreadable or empty archive.

Synchronize the service folder to another mounted destination:

sudo rsync -a /opt/my-service/ /mnt/backups/my-service/
  • rsync synchronizes two folders.
  • -a preserves common metadata and copies recursively.
  • The trailing slash on /opt/my-service/ means copy the folder contents.
  • If you later want the destination to mirror deletions too, test on a throwaway folder first and check the source and destination paths carefully.

Windows reference point: rsync is similar in purpose to robocopy, and a tar archive is comparable to a ZIP backup. Neither becomes an off-site backup if it remains on the same VPS disk.

Keep at least one copy on another machine or storage service, and test a restoration in an isolated folder.

Maintain the VPS

For a regular check:

sudo apt update
sudo apt upgrade
sudo systemctl --failed
df -h
free -h
  • apt update looks for currently available package versions.
  • apt upgrade proposes their installation.
  • systemctl --failed lists systemd services currently in failure state.
  • df -h checks disk space.
  • free -h checks memory.

Windows reference point: this covers the role of Windows Update, the Services console, Task Manager, and the Storage view.

Read the proposed changes before a major update, then check the status and logs of your services.

A safe workflow for installing any service

When you later install a website, bot, API, database, or game tool, follow this order:

  1. Read its official prerequisites and identify the runtime, ports, and persistent folders.
  2. Connect through SSH with the BoxToPlay root account.
  3. Install only the required dependencies with apt.
  4. Create a dedicated folder under /opt or use the documented location.
  5. Upload or download files from the official source.
  6. Inspect archives before extracting them into an isolated folder.
  7. Create a service account and apply limited permissions.
  8. Store configuration and secrets with restrictive access.
  9. Run the application locally and read its logs.
  10. Configure durable startup with systemd or Docker.
  11. Test its local port on 127.0.0.1.
  12. Configure the firewall, DNS, reverse proxy, and HTTPS when required.
  13. Prepare a backup and verify a restoration.

If the application is better suited to containers, continue with our guide: Install Docker on Linux: A Practical Getting-Started Guide.

VPS readiness checklist

Before putting a service online, confirm that:

  • you understand each command before running it.
  • the time zone is correct and the clock is synchronized.
  • your automatic security update strategy has been checked.
  • you can connect as root and you understand whether any additional user has sudo privileges.
  • SSH key authentication works from a second terminal.
  • the system and installed packages are updated.
  • the application runs under a dedicated account.
  • configuration files and secrets are not readable by everyone.
  • you know how to inspect CPU, memory, disk, processes, ports, and logs.
  • the firewall keeps SSH available and opens only required ports.
  • the application can restart after a reboot.
  • a backup exists outside the VPS and a restoration has been tested.

Choose a VPS sized for your service

A good setup also depends on sufficient CPU, RAM, storage, and network capacity. You can compare available configurations on the BoxToPlay VPS hosting page.

Start with the resources your application actually needs, monitor real usage, and increase the plan only when the measurements justify it.