Quick VPS Setup Guide

You have chosen your VPS provider and your server is ready. This chapter walks you through the essential initial setup steps to secure your server and prepare it for installing OpenClaw or PicoClaw. By the end, you will have a properly configured, secure VPS ready for your AI assistant.

Prerequisites

Before starting, you will need:

Your VPS IP address (from your provider's email or control panel)
Root password (usually emailed to you upon server creation)
An SSH client (built into macOS/Linux, PuTTY or Windows Terminal on Windows)

Step 1: First Login via SSH

Open your terminal and connect to your VPS as root:

ssh root@YOUR_VPS_IP

Replace YOUR_VPS_IP with the actual IP address from your provider.

Example:

ssh root@192.168.1.100

When prompted, enter the root password provided by your VPS host. If this is your first connection, you will see a message about host authenticity. Type yes to continue.

Step 2: Update the System

Before installing anything, update all system packages to the latest versions:

On Ubuntu/Debian:

apt update && apt upgrade -y

On Arch Linux:

pacman -Syu

This ensures you have the latest security patches and bug fixes. Depending on your VPS image, this may take a few minutes.

Step 3: Create a Non-Root User

Running everything as root is a security risk. Create a dedicated user for daily operations:

# Create a new user (replace 'assistant' with your preferred username)
useradd -m -s /bin/bash assistant

# Set a password for the new user
passwd assistant

# Add the user to the sudo group
usermod -aG sudo assistant

When prompted, enter and confirm a strong password for your new user.

Why this matters: If your AI assistant is compromised, the attacker gains only limited privileges, not full root access to your system.

Step 4: Set Up SSH Key Authentication

SSH keys are more secure than passwords and more convenient. Here is how to set them up.

On Your Local Computer (Not the VPS)

Check if you already have an SSH key:

ls ~/.ssh/id_*.pub

If you see files like id_rsa.pub or id_ed25519.pub, you already have a key. Skip to "Copy Your Key to the VPS."

Generate a new SSH key (if needed):

ssh-keygen -t ed25519 -C "your-email@example.com"

When prompted:

Press Enter to accept the default location
Enter a passphrase (optional but recommended)

Copy Your Key to the VPS

From your local computer:

ssh-copy-id assistant@YOUR_VPS_IP

Enter your user's password when prompted. This copies your public key to the VPS.

Test the key-based login:

ssh assistant@YOUR_VPS_IP

You should log in without entering a password (or only your key passphrase).

Step 5: Configure SSH for Security

Now we will harden the SSH configuration. These are basic steps; the premium SSH hardening chapter covers advanced techniques.

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Make these changes:

Disable root login:

PermitRootLogin no

Use key authentication only:

PasswordAuthentication no
PubkeyAuthentication yes

Change the default port (optional but recommended):

Port 2222

Choose any port between 1024 and 65535
Remember this port for future logins

Reduce login grace time:

LoginGraceTime 30

Save and exit: Press Ctrl+X, then Y, then Enter.

Restart SSH to apply changes:

sudo systemctl restart sshd

Test the new configuration:

Important: Before closing your current SSH session, open a new terminal and test:

# If you changed the port (example: 2222)
ssh -p 2222 assistant@YOUR_VPS_IP

# If you kept port 22
ssh assistant@YOUR_VPS_IP

Only close your original session after confirming the new one works!

Step 6: Set Up the Firewall (UFW)

A firewall controls which network connections are allowed. We will use UFW (Uncomplicated Firewall) on Ubuntu/Debian.

Install UFW (if not already installed):

sudo apt install ufw -y

Set default policies:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH connections:

If you kept the default SSH port (22):

sudo ufw allow 22/tcp

If you changed the SSH port (example: 2222):

sudo ufw allow 2222/tcp

Allow other necessary ports:

For OpenClaw (default port 18789):

sudo ufw allow 18789/tcp

For PicoClaw Web UI (default port 18800):

sudo ufw allow 18800/tcp

For HTTP/HTTPS (if running a web server):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Enable the firewall:

sudo ufw enable

Verify the rules:

sudo ufw status verbose

You should see your allowed ports listed.

Step 7: Set Up Automatic Security Updates

Keep your system secure with automatic updates.

On Ubuntu/Debian:

Install the unattended-upgrades package:

sudo apt install unattended-upgrades -y

Enable automatic updates:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select "Yes" when prompted.

Configure what gets updated:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Ensure these lines are uncommented (remove //):

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}ESMApps:${distro_codename}-apps-security";
    "${distro_id}ESM:${distro_codename}-infra-security";
};

Save and exit.

Step 8: Install Docker

Follow the Docker installation steps from the previous chapter, or run these quick commands:

Quick install script (Ubuntu/Debian):

# Update and install prerequisites
sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg

# Add Docker's GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# Add user to docker group
sudo usermod -aG docker $USER

Log out and back in for the docker group change to take effect:

exit
# Then log back in via SSH

Verify Docker installation:

docker run hello-world

Step 9: Install Mise (Recommended)

Mise is a tool version manager that lets you install multiple versions of Node.js, Elixir, Erlang, and other development tools. This prevents version conflicts when you work on multiple projects that need different language versions.

# Install mise
curl https://mise.run | sh

# Add to shell
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
echo 'eval "$("$HOME/.local/bin/mise" activate bash)"' >> ~/.bashrc
source ~/.bashrc

# Install Node.js (needed for OpenClaw)
mise use -g nodejs@latest

# Install Erlang and Elixir (needed for Phoenix/Elixir projects)
mise use -g erlang
mise use -g elixir@latest

# Verify
mise --version
node --version
elixir --version

Why mise? Without a version manager, you are stuck with whichever version of Node.js or Elixir your system package manager provides (often outdated). Mise gives you the latest stable version and lets you switch between versions per project.

Step 10: Set Timezone and NTP

Accurate time is important for scheduled tasks and logging.

Set your timezone:

# List available timezones
timedatectl list-timezones | grep -E 'New_York|London|Berlin|Tokyo'

# Set your timezone (example: US Eastern)
sudo timedatectl set-timezone America/New_York

Ensure NTP (Network Time Protocol) is enabled:

sudo timedatectl set-ntp true

Verify:

timedatectl

You should see "NTP enabled: yes" and the correct local time.

Step 11: Basic Monitoring Setup

Install essential monitoring tools to keep an eye on your system:

# htop - interactive process viewer
sudo apt install -y htop

# iotop - disk I/O monitor
sudo apt install -y iotop

# ncdu - disk usage analyzer
sudo apt install -y ncdu

Quick usage:

# View running processes and resource usage
htop

# Check disk usage by directory
ncdu /

Setup Complete: Verification Checklist

Your VPS is now ready. Verify everything is working:

Can log in via SSH key (no password): ssh -p PORT assistant@IP
Root login is disabled
Firewall is active: sudo ufw status
Docker is working: docker run hello-world
Mise is installed (optional): mise --version
Automatic updates are enabled
Timezone is correct: timedatectl
System is up to date: sudo apt update && sudo apt upgrade -y

Common First-Time Issues

"Permission denied (publickey)"

Cause: SSH key not properly copied or SSH agent not running.

Solution:

# On your local machine, check SSH agent
ssh-add -l

# If no keys listed, add your key
ssh-add ~/.ssh/id_ed25519

# Try copying the key again
ssh-copy-id -p PORT assistant@IP

"Connection refused" on new SSH port

Cause: Firewall blocking the new port or SSH not restarted properly.

Solution:

Log in via your original session (keep it open!)
Check firewall: sudo ufw status
Verify SSH is listening: sudo ss -tlnp | grep ssh
Check SSH config for errors: sudo sshd -t

Docker commands fail with permission denied

Cause: User not in docker group or shell not reloaded.

Solution:

# Verify group membership
groups

# If docker is not listed, log out and back in
exit
# Reconnect via SSH

What is Next?

Your VPS is now secured and ready. The next chapters cover:

VPS Security 101 - Essential security practices for your server
SSH Hardening (Premium) - Advanced SSH security with automation
Installing OpenClaw and PicoClaw - Deploying your AI assistants

Next: VPS Security 101 - Essential security practices every SaaS founder must know.

Quick VPS Setup Guide

Prerequisites

Step 1: First Login via SSH

Step 2: Update the System

Step 3: Create a Non-Root User

Step 4: Set Up SSH Key Authentication

On Your Local Computer (Not the VPS)

Copy Your Key to the VPS

Step 5: Configure SSH for Security

Step 6: Set Up the Firewall (UFW)

Step 7: Set Up Automatic Security Updates

Step 8: Install Docker

Step 9: Install Mise (Recommended)

Step 10: Set Timezone and NTP

Step 11: Basic Monitoring Setup

Setup Complete: Verification Checklist

Common First-Time Issues

"Permission denied (publickey)"

"Connection refused" on new SSH port

Docker commands fail with permission denied

What is Next?

Stay in the loop