Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOn a fresh Rocky Linux or AlmaLinux VPS, the safest first hour is a controlled sequence: confirm a recovery path, patch the system, establish a privileged non-root account, prove key-based SSH access in a second session, then tighten SSH and firewalld without closing your own connection. Leave SELinux enforcing and verify that backups or provider snapshots can actually restore the server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Rocky Linux and AlmaLinux share the RHEL-family administration model, so the workflow is largely the same. Account defaults, cloud-image provisioning, available packages, and console tools can differ by major release and VPS provider; check the image you selected before applying a policy copied from another system.
As an Amazon Associate I earn from qualifying purchases.
Before you run a command: record access and recovery details
Write down the VPS public IP address, the initial username, the SSH port if it is not the default, and the distribution release shown by the provider. Rocky Linux documentation specifically cautions that the IP address is especially important when you do not have easy physical or console access. Keep the provider’s web console, serial console, rescue mode, or equivalent recovery channel open and tested before changing authentication or firewall rules.
- Primary path: your current SSH connection.
- Secondary path: a provider console or rescue environment that does not depend on SSH.
- Recovery point: a fresh VPS snapshot or backup, with a documented restore procedure.
- Configuration record: image name, release, IP addresses, DNS name, SSH port, and any services the workload must expose.
Do not start by disabling root or password login, and do not remove SSH from the firewall, until a separate key-authenticated session has succeeded. A typo in sshd_config or a firewall zone can otherwise turn a routine hardening change into a console-only recovery job.
Rocky Linux and AlmaLinux: what is common and what varies
Both distributions use DNF for package management and firewalld for the standard host firewall in the setup guidance used here. They also use SELinux as the mandatory access-control layer. That common foundation means commands such as package updates, service inspection, and firewall verification are familiar on either system.
| Decision point | Rocky Linux | AlmaLinux | What you should verify |
|---|---|---|---|
| VPS image availability | Depends on the provider and selected release. | Depends on the provider and selected release. | Whether the exact major release, architecture, cloud-init behavior, and rescue console are offered. |
| Initial account behavior | Rocky Linux 10 installation documentation says the root account is disabled by default and the installation-created user should have administrative privileges. | Cloud images and deployment tools can provision a different initial user or root state. | Test the actual login account and its sudo or wheel membership before changing SSH policy. |
| Package and repository policy | Uses DNF; repository contents and enabled repositories depend on release and image. | Uses DNF; AlmaLinux recommends updating after repository changes. | Enabled repositories, pending updates, third-party repositories, and the provider’s image documentation. |
| Firewall administration | Rocky guidance uses firewalld and warns not to remove SSH from a remote server’s firewall. | Firewalld is the same familiar administration model. | Active zone, interface assignment, permanent rules, and the ports your workload actually needs. |
| SELinux administration | Keep enforcing unless you have a specific, diagnosed policy requirement. | Keep enforcing unless you have a specific, diagnosed policy requirement. | Current mode, application labels, and policy messages after deploying software. |
| Console, snapshots, and backups | Tools and retention vary by provider. | Tools and retention vary by provider. | How to open the console, create a snapshot, restore it, and retrieve files independently of the VPS. |
| Documentation and support | Use the release-specific Rocky documentation plus your provider’s image notes. | Use the release-specific AlmaLinux documentation plus your provider’s image notes. | Whether a command applies to your major release and image rather than a different RHEL-family build. |
There is no authoritative, comparable figure for setup time, setup cost, or the frequency of VPS lockouts. Treat those as dependent on the provider, image, and your own changes, not as fixed properties of either distribution.
Step 1: confirm the host, release, and network path
Log in through SSH while the provider console remains available. Capture basic identity and release information so later troubleshooting is tied to the actual image:
hostnamectl
cat /etc/os-release
ip address
ip route
whoami
id
sudo -vsudo -v checks whether the current account can obtain administrative credentials without changing anything. If it fails, stop and use the provider’s documented account-recovery process; do not guess at root credentials or proceed with firewall changes.
Check the provider panel for the assigned public IPv4 and, if supplied, IPv6 address. Confirm that reverse DNS or a hostname is set only if your workload needs it. The important first-hour result is not a polished hostname; it is knowing exactly which address and recovery channel you can use if SSH stops responding.
Step 2: update the operating system and repositories
Apply available updates before installing application software. DNF’s update and upgrade commands are equivalent in the ordinary workflow:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo dnf update
# or
sudo dnf upgradeIf you are intentionally applying security advisories without unrelated feature or bug-fix updates, DNF also supports:
sudo dnf --security updateA security-only transaction is a narrower choice, not a substitute for a normal maintenance plan. Read the transaction summary, confirm the repositories being used, and reboot when the update or provider guidance requires it. After adding or changing repositories, AlmaLinux documentation recommends updating again so package metadata and installed packages are synchronized.
Do not assume a command copied from another major release has identical package names or service units. Record the release from /etc/os-release, inspect enabled repositories with sudo dnf repolist, and consult the current release documentation before adding repositories in production.
Step 3: establish a working administrative account
Use a normal login account with sudo access rather than conducting routine administration as root. Rocky Linux 10’s installer documents the root account as disabled by default and expects the installation-created user to have administrative privileges, but a VPS cloud image can behave differently.
Recommended Free Tools
Verify the current account’s groups and sudo capability:
id
sudo -lIf you need to create an account and have an authorized administrative path, create it, assign a strong password for emergency console use if your policy permits, and add it to the administrative group used by the image:
sudo useradd --create-home --shell /bin/bash adminuser
sudo passwd adminuser
sudo usermod --append --groups wheel adminuser
sudo visudoUse visudo to confirm the wheel rule is enabled according to the distribution’s sudoers configuration. The exact username and password policy are yours to choose; never paste a shared password into a script or leave an unknown provider-created account as your only administrator.
Step 4: install and prove SSH key access before hardening
Create or select a key on your workstation
An Ed25519 key is a practical default on current OpenSSH clients:
ssh-keygen -t ed25519 -C "your-device-name"Protect the private key with a passphrase and keep a second, securely stored recovery copy if your operating procedure allows it. Only the public key belongs on the VPS.
Install the public key for the administrative account
Use your provider’s key injection feature or copy the key while password authentication still works:
ssh-copy-id adminuser@SERVER_IPIf ssh-copy-id is unavailable, append the public-key line to the account’s ~/.ssh/authorized_keys through the provider console, then ensure the directory and file are owned by that user and are not writable by other users. A malformed line, wrong ownership, or an incorrect home directory is a common reason for a legitimate key being ignored.
Open a second session and test it
Keep the original SSH window untouched. Open a new terminal and connect explicitly as the new account:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →ssh adminuser@SERVER_IP
sudo -vDo not continue until this second session authenticates with the key and can run sudo. This two-session test is the safety gate for every subsequent access-policy change.
Validate and then restrict the SSH daemon
Inspect the effective configuration first:
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) 'Edit the distribution’s SSH server configuration (commonly /etc/ssh/sshd_config) and set the policy you have just proven:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesSome images include drop-in files under /etc/ssh/sshd_config.d/; a later drop-in can override a line in the main file. Validate syntax before applying anything:
sudo sshd -tIf validation succeeds, reload the daemon while both sessions remain open:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutesudo systemctl reload sshd
sudo systemctl status sshd --no-pagerStart another fresh key-based connection. Only after it succeeds should you close the original session. If your provider uses a nonstandard SSH port, specify it in every test and allow that port in firewalld before removing any old rule.
Root policy needs one qualification: Rocky Linux 10’s documented installer default already disables root, while a provider cloud image can enable or provision it differently. Check the actual state rather than assuming either behavior.
Step 5: configure firewalld without locking yourself out
Inspect zones and the current policy
sudo systemctl status firewalld --no-pager
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-allThe active zone is the policy attached to the network interface carrying your traffic. If more than one zone is active, inspect each explicitly:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo firewall-cmd --zone=public --list-allReplace public with the zone shown for your interface. Do not make assumptions based on a zone name alone.
Allow only required services
For a typical web host, SSH plus HTTP and HTTPS might be required. Add only what the workload needs, and make the change permanent in the same transaction:
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=httpsIf your SSH daemon listens on a custom port, use a firewalld service definition or a port rule appropriate to your policy rather than blindly adding the default SSH service. Database, cache, administration, and monitoring ports should generally be restricted to the addresses that need them, not exposed globally.
Reload and verify the effective rules
sudo firewall-cmd --reload
sudo firewall-cmd --zone=public --list-services
sudo firewall-cmd --zone=public --list-ports
sudo firewall-cmd --get-active-zonesRocky Linux’s guidance states: “Never remove the SSH service from a remote server’s firewall!” Keep an SSH path permitted until you have deliberately moved to another management channel and tested it. A permanent rule that has not been reloaded is not yet the running policy; conversely, a temporary runtime rule disappears after a reload or reboot. Check both the intended permanence and the current runtime state when troubleshooting.
Step 6: keep SELinux enforcing
Check the current mode:
getenforce
sestatusThe baseline should be Enforcing. Do not disable SELinux simply because an application initially receives a permission error. SELinux can block an operation that ordinary Unix permissions allow, which is precisely why turning it off hides the policy problem rather than solving it.
When an application fails, identify the denied operation, check file labels and service context, and use the distribution’s documented policy tools to grant the narrow permission required. Make one change at a time, retest the application, and record the policy adjustment. If you must use a temporary permissive mode for diagnosis, treat it as a short-lived troubleshooting state, restore enforcing mode, and do not make permissive mode the production baseline.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 7: confirm backups, snapshots, and restoration
Before deploying production data, verify the provider’s snapshot or backup feature and your independent backup plan. A snapshot is useful for rapid rollback, but it is not evidence that you can recover a deleted file or rebuild on a different host unless you have tested that operation.
- Take a fresh snapshot after the baseline is stable.
- Confirm the retention period, storage location, and whether snapshots survive VPS deletion.
- Back up application data and configuration outside the running disk when the workload requires it.
- Perform a test restore or file recovery and record the elapsed steps, credentials, and DNS changes needed to return to service.
Keep the provider console or rescue procedure in the same recovery record. A backup that cannot be reached because SSH policy or networking is broken does not replace an out-of-band path.
First-hour verification checklist
Use this checklist after the changes, from a new terminal where possible:
- The documented public IP and provider console both work.
sudo dnf updateor the selected maintenance transaction completed without unresolved dependency errors.- The administrative account can run
sudo; routine work does not require a root login. - A new SSH session succeeds with the key; password login and root login are disabled only after that test.
sudo sshd -tpasses, andsystemctl status sshdis healthy.- The active firewalld zone is known, required services are present, and unnecessary services or ports are absent.
- SELinux reports
Enforcing. - A snapshot or backup exists, and the restore method is understood.
What to do when a change goes wrong
SSH rejects the new key
Keep the original session open, or enter through the provider console. Check the username, home directory, authorized_keys contents, ownership, and permissions. Run sshd -t and inspect the SSH service log through the system journal. Do not repeatedly restart the daemon while guessing; restore the last known-good configuration, validate it, and test from a second terminal.
You cannot connect after a firewalld change
Use the console or rescue channel and inspect firewall-cmd --get-active-zones and the zone’s service and port lists. Re-add the correct SSH service or custom port to the zone attached to the VPS interface, reload, and test from a new connection. If the wrong zone was edited, changing the unused zone will not restore access.
An application fails with SELinux enforcing
Do not make disabling SELinux the first fix. Identify the denied action, confirm that Unix ownership and paths are correct, and apply the smallest supported policy or labeling change. Keep a record of the change so a package update or rebuild does not silently remove it.
Free tools Windows power users keep installed
One-click scans. No signup required.
The image does not match the instructions
Stop and identify the major release, enabled repositories, initial account, service names, and provider cloud-init behavior. Commands and package names can vary by major release and image. Recheck current Rocky Linux or AlmaLinux release documentation and the provider’s image notes before continuing.
Version and currency notes
A checklist published by KDE Red Hat in 2026 reports testing on AlmaLinux 10.2 with DNF 4.20.0 and OpenSSH 9.9p1 on July 17, 2026. Those are test-context details, not a promise that every VPS currently runs those versions. Your provider may supply a newer or older major release, different OpenSSH defaults, or a customized cloud image. Treat the release and package metadata on your own server as authoritative for the commands you execute.
The durable principles are therefore sequencing and verification: preserve a recovery path, update first, prove a privileged key-based login, validate SSH syntax before reload, keep SSH permitted in the correct firewalld zone, leave SELinux enforcing, and test restoration before production work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
