Installing an operating system on a VPS means choosing a distribution and then reinstalling from the provider's panel. The install itself takes a few minutes. The choice is worth five minutes of thought, because moving between distributions later means rebuilding.
Choose by support lifetime, not by preference
Distributions differ far less than people argue about. What genuinely matters is how long the version receives security updates.
Long-term support releases get patches for years. That is what a server wants; a version that stops receiving updates is a version you have to migrate off on someone else's schedule.
Short-lived releases exist for desktops and testing. Putting one on a server means a distribution upgrade every nine months, and distribution upgrades are exactly the operation that breaks things.
Ahosting's FFmpeg VPS ships Ubuntu 24.04, an LTS release, which is a sensible default for most workloads.
The practical differences
Package availability and freshness. Some distributions ship newer versions of language runtimes and databases; others prioritise stability and ship older ones with backported fixes. If your application needs a specific version, check before choosing.
Documentation volume. This matters more than it sounds. When something breaks at midnight, the distribution with more answers written about it is the easier one to run.
Package names and file locations differ between families. Following instructions written for one distribution on another produces confusing failures, and this is a real ongoing cost of choosing something unusual.
Reinstalling
Reinstalling erases everything. There is no partial reinstall and no recovery afterwards.
So: take a backup off the server, confirm it is complete, and only then reinstall. Doing this in the wrong order is not recoverable. Backing up your VPS deals with what a complete backup contains.
From the provider's panel, choose the image and confirm. You receive fresh credentials when it completes, and the old ones stop working.
Immediately after
A fresh server is reachable and unprotected, and automated scanning finds it within minutes. Do these before anything else:
- Connect and create a normal user with sudo.
- Set up key authentication, test it in a second session, then disable password logins.
- Enable a firewall: allowing SSH first, or you disconnect yourself.
- Apply all pending updates.
- Turn on automatic security updates.
Securing your VPS explains each. The window between a server becoming reachable and being secured is when servers get compromised.
Minimal images
Choose a minimal or server image instead of one with a desktop environment. A graphical interface on a server consumes memory permanently and adds packages you will never use but must still patch.
Every listening service is something to maintain. Fewer is better, and adding what you need is easier than working out what to remove.
Control panel or not
Some images include a control panel. That is a real convenience and a real trade.
A panel gives you a familiar interface and manages configuration for you. It also occupies memory, expects to control the services it manages, and can conflict with configuration you make by hand.
Decide before installing. Adding a panel to a server you have already configured manually is considerably more work than starting with one.
With the system in place, Setting Up Web Applications on VPS deals with getting an application running on it.
Which distribution to install is decided by your panel and by support lifetime. See How to Choose a Linux Distribution for Hosting.
Check the image is what it claims to be
Provider images vary in what they include, and a few minutes on a fresh machine tells you what you actually received.
cat /etc/os-release | head -3 uname -r systemctl list-units --type=service --state=running --no-pager | head -15 ss -tlnp
Read what is listening before anything else. An image shipping with a database, a mail server or a monitoring agent you did not ask for is a service to remove rather than to leave running.
Compare the kernel version against the distribution's current one. An image built months ago is months behind, and the first task on any new machine is applying what has accumulated since it was made.
Know how long this version is supported
The support end date decides when you next rebuild, and picking it deliberately is the difference between a planned migration and an urgent one.
cat /etc/os-release | grep -i version apt-get -s dist-upgrade 2>/dev/null | tail -3 dnf check-update 2>/dev/null | tail -3
A version near the end of its life is a machine you will rebuild within the year, whatever else happens. Choosing the newest long term release instead buys several years of not thinking about it.
Write the end date down with the server's other details. It is the one maintenance deadline that cannot be deferred, since a system past it stops receiving fixes entirely and nothing announces the transition. Managing multiple servers consistently covers keeping that record.
Set the hostname and time before anything else
Two settings are assumed correct by everything installed afterwards, and correcting them later means revisiting all of it.
hostnamectl set-hostname server.example.com timedatectl set-timezone UTC timedatectl status | head -5 hostname -f
A machine with the wrong time produces certificates that are not yet valid, logs that cannot be correlated with anything, and scheduled jobs that run at unexpected moments.
Using a single timezone across every server removes an entire class of confusion when reading logs from more than one machine, and the usual choice is the one with no seasonal changes.
Remove what you did not ask for
A fresh image ships with more than a server needs, and every extra service is a process to update and a port to consider.
ss -tlnp systemctl list-unit-files --state=enabled --no-pager | wc -l systemctl disable --now avahi-daemon cups 2>/dev/null
Read the listening list and account for every entry. Anything you cannot explain is either something to learn about or something to remove.
Do this before installing the application rather than after, since it is easier to tell what belongs when almost nothing does. Securing your VPS covers the rest of the first hour.