A fresh Rocky Linux or AlmaLinux VPS should not host a game server, database, or public website until you have secured access, applied updates, configured the firewall, checked SELinux, and confirmed recovery options. The safest order is: preserve console access, update the system, create and test an administrative account, establish a second SSH-key session, then tighten SSH and firewalld rules. Keep one existing session open while changing remote-access settings.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What to do first on a new Rocky Linux or AlmaLinux VPS
Before installing a game server or exposing any application, complete this sequence:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Record the VPS address and keep the provider’s web console, serial console, or rescue mode available.
- Log in using the account supplied by the image and determine whether it is root or a provisioned administrator.
- Update packages with DNF, using the security-only option when that is your specific objective.
- Verify a normal administrative account with
sudoor membership in thewheelgroup. - Install and test an SSH public key from a second terminal before changing authentication policy.
- Inspect firewalld’s active zone and permit only the services the workload needs.
- Leave SELinux in enforcing mode and solve policy denials rather than disabling it as a shortcut.
- Confirm that snapshots or backups exist and that you know how to restore one.
This order prevents the most expensive first-day mistake: closing the only working SSH path while the server is still being configured.
1. Preserve a recovery path before changing anything
Record the address and image details
Write down the VPS IPv4 or IPv6 address, the distribution and major release, the image creation date if shown by the provider, and the initial login account. Rocky Linux installation documentation emphasizes that the address is especially important when you do not have easy physical or console access. For a cloud image, the provider’s defaults can differ from a manual installation, so do not assume that a Rocky Linux 10 rule applies unchanged to every image.
#1 Best Overall
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Keep the provider control-panel console or rescue environment open in another browser tab. It is your fallback if a firewall rule, SSH syntax error, account permission, or SELinux policy prevents normal login. Do not terminate your initial SSH session until a separate key-based session has successfully completed all required checks.
Check who you are and whether sudo works
Run the following harmless checks before making policy changes:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →whoami
id
sudo -vIf sudo -v succeeds, the account can obtain administrative privileges. If it fails, use the provider console to create or repair an administrator before proceeding. On Rocky Linux 10’s documented installer, the root account is disabled by default and the installation-created user is expected to have administrative privileges. A provider’s cloud image may still expose a different initial account, so verify the actual state instead of relying on the installer default.
2. Update Rocky Linux or AlmaLinux with DNF
Apply the normal update set
Run one of these commands as an administrator:
sudo dnf update
sudo dnf upgradeOn these RHEL-family systems, update and upgrade are commonly equivalent operations for bringing installed packages to the newest versions available from enabled repositories. AlmaLinux documentation recommends updating after repository changes, so repeat the update after adding or changing a repository that your game server depends on.
Use a security-only transaction when that is the requirement
sudo dnf --security updateThis asks DNF to apply advisories classified as security updates rather than every available package update. It is useful for a tightly controlled maintenance window, but it is not a substitute for a complete update plan: application compatibility, kernel updates, and non-security bug fixes may still matter to a production game server.
Reboot only when the update requires it
A kernel or core-library update can require a reboot. Read DNF’s transaction summary and schedule a restart when players can tolerate a maintenance interruption. If you reboot, reconnect through the console or SSH and run sudo dnf update again to confirm that no important updates remain. Do not begin firewall or SSH changes while a package transaction is still running.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Package names, repository layouts, and command behavior can vary by major release and provider image. Check the documentation for the exact Rocky Linux or AlmaLinux release installed on the VPS before copying a command into a production machine.
3. Create or verify a dedicated administrative account
Why a normal administrator is safer
Use a named account for routine administration and reserve direct root access for recovery tasks that genuinely require it. A named account gives you an auditable identity, can use sudo for individual commands, and avoids making a shared root password the foundation of your server’s security.
Create the account when the image did not provide one
From an account that already has administrative rights, create a user and assign it to the administrative group:
sudo useradd --create-home --shell /bin/bash adminname
sudo passwd adminname
sudo usermod --append --groups wheel adminnameReplace adminname with your own account name. Confirm group membership with:
id adminnameThe output should include wheel. Open a new session as that user and test:
ssh adminname@SERVER_IP
sudo -vDo not remove the original account or alter root’s SSH policy until this new login has worked from a second terminal.
Check the account’s home and SSH directory permissions
SSH rejects keys when ownership or permissions are too open. If you are installing a key manually, use the target user’s home directory and apply restrictive permissions:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R "$USER":"$USER" ~/.sshThe commands must be run as the target user, or the ownership must be adjusted explicitly. A provider’s image may already have an authorized_keys file; preserve existing keys until the replacement key has been tested.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute4. Establish SSH-key access before tightening SSH
Copy and test a public key
From your local computer, copy the public key to the administrative account. If your environment provides ssh-copy-id, the usual form is:
Rank #2
- High-Performance NAS with Powerful Procesor: Intel Core 5 320 is ideal for small offices, & More. You can enjoy smooth performance and seamless collaboration, while making use of advanced features like Docker and virtual machines. It works semalessly across every device inluding Windows, macOS, Linux, iOS, Android or Google services and so on.
- Better Way to Store Than External Drives: NAS offers centralized storage, automatic backups, remote access, and a wide range of RAID options for easy data recovery even if a drive fails. Massive Storage Capacity: Never worry about storage limits again. With up 144TB capacity, you can store 50 million 1MB photos or 98K 1.5GB movies，5 million 30MB songs! *Hard Drives not included.
- Secure Private Cloud: Retain 100% data ownership with advanced encryption to protect your files. Flexible permission management makes it easy to protect your privacy when collaborating with others.
- AI-Powered Photo Album: Automatically organizes your photos by recognizing faces, scenes, objects, and locations. It can also instantly remove duplicates, freeing up storage space and saving you time.
- User-Friendly App: Simple setup and easy file-sharing on Windows, macOS, Android, iOS, web browsers, and smart TVs, giving you secure access from any device.
ssh-copy-id adminname@SERVER_IPAlternatively, append the contents of your local public-key file to the server user’s ~/.ssh/authorized_keys through the provider console. Never paste a private key onto the VPS.
Open a second terminal and connect explicitly with the key:
ssh -i ~/.ssh/your_key adminname@SERVER_IPConfirm that the session starts without asking for the account password and that sudo -v succeeds. Keep the first session open while you perform the remaining SSH steps.
Validate the daemon configuration before reloading it
Before changing /etc/ssh/sshd_config, make a backup copy and edit only the settings you understand. Then validate the syntax:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
sudo sshd -tAn empty response from sshd -t indicates that the configuration passed the parser. If it reports an error, restore the backup or correct the specific line before attempting a reload.
Disable password authentication and direct root login only after the key works
Once the second key-based session is confirmed, set the relevant SSH options in the server configuration:
PasswordAuthentication noprevents password-based SSH authentication.PermitRootLogin noprevents direct root SSH login.
The exact effective value can be affected by included configuration files, so inspect the distribution’s current SSH configuration if a setting appears to be ignored. Run sudo sshd -t again, then reload the service without closing your existing sessions:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemssudo systemctl reload sshdTest a completely new connection. If it fails, use the still-open session or provider console to revert the last change. Do not log out of every channel until the new policy has been proven.
5. Configure firewalld without locking yourself out
Understand zones before adding rules
Firewalld is the default firewall application in Rocky Linux guidance and is also used in AlmaLinux setup instructions. First inspect the active zones and their current services:
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --list-allIf more than one zone is active, run sudo firewall-cmd --zone=ZONE --list-all for each relevant zone. The zone attached to the VPS network interface is the one that controls incoming traffic on that interface.
Keep SSH open while you work
Rocky Linux’s documentation gives an explicit warning: “Never remove the SSH service from a remote server’s firewall!” Keep the SSH service permitted until you have an alternative management path that is known to work. If you use a nonstandard SSH port, allow that port in the correct zone before removing or changing the default service rule, and verify the provider’s network firewall allows it too.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Add only the services your workload needs
For a game server, this normally means the specific UDP or TCP port documented by that game’s server software, not every available service. A public website might additionally need HTTP or HTTPS; a database should generally remain private and reachable only from the application network.
For a service represented by a firewalld service definition, add it permanently and then reload:
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reloadDo not add http or https merely because a command example contains them; omit services your VPS does not run. For a game port that is not represented by a predefined service, use the exact protocol and port required by that server software, for example:
sudo firewall-cmd --permanent --add-port=GAME_PORT/udp
sudo firewall-cmd --reloadReplace GAME_PORT with the documented port. If the game uses both protocols, create one rule for each. Avoid broad port ranges unless the software explicitly requires them.
Rank #3
- Built for Local AI Development: AMD Ryzen AI Halo is designed for local AI development and inference, featuring 128GB unified memory and support for up to 200B parameter models to build and run intensive AI workloads locally.
- 128GB Unified Memory: Features 128GB LPDDR5x unified memory at 8000 MT/s with 256 GB/s memory bandwidth, providing a shared memory pool across the CPU, GPU, and NPU to support larger AI models.
- AMD Ryzen AI Max+ 395 Processor: Features 16 cores, 32 threads, and Zen 5 architecture, paired with AMD Radeon 8060S integrated graphics featuring 40 RDNA 3.5 compute units and an AMD XDNA 2 NPU with up to 50 TOPS.
- Linux AI Developer Platform: Purpose-built for Linux-based AI development with full AMD ROCm software support and preloaded tools, models, and workflows optimized for local AI development.
- Compact, Connected Design: Includes a 2TB M.2 SSD, 10GbE LAN, Wi-Fi 7, Bluetooth 5.4, USB-C connectivity, and HDMI 2.1b.
Verify the permanent and runtime configurations
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --list-allThe first command shows the currently loaded runtime rules; the second shows what will persist across a reload or reboot. Confirm that SSH remains listed and that every game port appears with the correct protocol. A provider-level firewall or security group can still block traffic even when firewalld is correct, so check both layers when players cannot connect.
6. Keep SELinux enforcing
Check the current mode
getenforce
sestatusAn enforcing result means SELinux both labels resources and blocks actions that violate policy. The current cross-distribution setup checklist recommends leaving it enforcing and addressing application policy requirements instead of disabling it during baseline setup.
Diagnose policy problems instead of switching SELinux off
A game server may need access to a custom data directory, a listening port, or a system service integration that the default policy does not permit. First verify ordinary causes such as file ownership, directory permissions, and the service’s configuration. Then inspect SELinux denial records and apply a narrowly scoped, documented policy adjustment appropriate to the installed release. Do not make a blanket setenforce 0 change permanent simply because an application starts in permissive mode.
When moving files into a service directory, preserve or restore the expected security context rather than copying arbitrary labels. After a change, return to enforcing mode and test the service through the same path players will use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Confirm snapshots and backups before production work
Know what the provider can restore
Check whether the VPS control panel offers an on-demand snapshot, scheduled snapshots, image cloning, or file-level backup. Record how long each option is retained, whether it captures attached volumes, and whether restoration changes the IP address. These details vary by provider and plan, so the control panel’s current documentation is authoritative.
Test recovery, not just backup creation
A green backup status does not prove that a game world, configuration file, or database can be recovered. Before inviting players, identify the files that must survive a rebuild, make a backup, and verify that you can retrieve or restore them in a disposable environment. Keep at least one recovery path separate from the VPS itself.
Take a snapshot after the base operating-system update and account setup, before installing large game-server dependencies. Take another only when the server is in a known-good state; snapshots are a recovery tool, not a replacement for regular application-aware backups.
Recommended Free Tools
8. A practical first-hour checklist for a game VPS
- Access: VPS address recorded; provider console or rescue access tested.
- Identity: named administrator exists, belongs to
wheel, and can runsudo. - Updates: DNF transaction completed; any required reboot performed; update checked again afterward.
- SSH: public key works from a second terminal;
sshd -tpasses; restrictive options are changed only after testing. - Firewall: active zone identified; SSH retained; only required game and management ports are allowed; runtime and permanent rules match.
- SELinux: enforcing mode confirmed; no blanket disablement used to hide a policy issue.
- Recovery: snapshot or backup exists; restoration procedure and retention are understood.
Only after these checks should you install the game server, create its service account, open its documented port, and expose it to players.
Rocky Linux versus AlmaLinux for a VPS
Both distributions follow the same broad first-hour pattern: DNF for packages, firewalld for host firewall administration, SSH for remote management, and SELinux for mandatory access control. The meaningful differences are usually in the image and provider rather than in the security sequence.
| Decision point | Rocky Linux | AlmaLinux | What to verify on your VPS |
|---|---|---|---|
| Provider image availability | Depends on the provider and selected release. | Depends on the provider and selected release. | Whether the exact major release, architecture, cloud-init behavior, and console access are offered. |
| Initial account defaults | Rocky Linux 10 installer documentation says root is disabled by default and the created user should have administrative privileges. | Cloud-image provisioning can expose a provider-defined account and privileges. | Actual whoami, id, sudo access, and existing SSH keys. |
| Package and repository policy | Uses DNF; repositories and package availability depend on release and image. | Uses DNF; AlmaLinux documentation recommends updating after repository changes. | Enabled repositories, release support status, and any third-party repository requirements. |
| Firewall administration | Rocky guidance uses firewalld and warns not to remove SSH from a remote firewall. | AlmaLinux setup guidance also uses firewalld. | Active zone, provider network firewall, and required game protocols. |
| SELinux administration | Keep enforcing and adjust policy for applications. | Keep enforcing and adjust policy for applications. | Current mode, labels on game data, and any denial affecting the service. |
| Console, snapshots, and backups | Features are provider-specific. | Features are provider-specific. | Recovery channel, retention, volume coverage, and restore procedure. |
| Documentation and support | Use the current Rocky release documentation for installer and firewall behavior. | Use the current AlmaLinux release documentation for package and repository behavior. | Match every command to the installed major release and image. |
A provider’s image can therefore matter more than the distribution name. Select the image that supplies reliable console access, current security updates, a supported major release, and recovery tooling that fits your game community’s availability requirements.
Troubleshooting the common first-day failures
SSH stops working after a configuration change
Do not repeatedly restart the service from a disconnected client. Use the still-open session or provider console, run sudo sshd -t, and correct or restore the last edit. Confirm that the administrative user’s home, .ssh directory, and authorized_keys ownership are correct. If the firewall changed at the same time, inspect the active zone and restore the SSH service rule.
The key is ignored and SSH asks for a password
Connect with the intended private key explicitly, confirm that the matching public key is on the server, and check permissions on the home and .ssh paths. A key copied to root does not authenticate a different administrative user. Keep password authentication enabled until the key login has been proven; disable it only after the second session works.
Players cannot reach the game port
Check the game service’s listening address and protocol, then compare the port with both firewalld’s runtime rules and its permanent rules. Verify that the provider’s external firewall or security group allows the same port. A TCP rule does not permit UDP traffic, and an open host port cannot help if the game process is bound only to localhost.
The service works only when SELinux is permissive
Return to enforcing mode after testing and identify the denied operation. Check file labels and ownership on the game data directory, then apply the smallest release-appropriate policy change. Disabling SELinux removes a protection layer and leaves the underlying labeling or policy problem unresolved.
An update changed behavior or requests a reboot
Read the DNF transaction output, schedule the reboot during a maintenance window, and reconnect through the console or tested SSH key. Run the update check again afterward. Keep a known-good snapshot or backup from before major changes so you can roll back without guessing which package caused the regression.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When the VPS is ready for a game server
Provisioning is complete when you can reach the server through a tested key, recover through an independent console or backup, apply updates, explain every open firewall port, and keep SELinux enforcing while the intended service runs. At that point create a least-privilege service account for the game software, store its data in a backed-up location, open only its documented network ports, and record the final configuration. This makes later upgrades and incident recovery predictable instead of turning the first public launch into an access-risk experiment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
