Your First Hour With a WebGee Cloud Server: Setup, SSH Keys, Backups and DNS

A new cloud server arrives empty. In the next hour you install an operating system, get secure root access, and set up the few things that are painful to fix later: reverse DNS, backups and a way back in if you lock yourself out. Follow these steps in order.

Know your two control panels

You manage a cloud server in two places. The client area at my.webgee.com handles billing, renewals and cancellation. The Cloud Console at console.webgee.cloud handles the server itself: power, operating system, backups, networking, SSH keys and console access. Rescue mode, boot media, reverse DNS, DNS resolvers and sharing access with someone else are only in the Cloud Console.

The easiest way in is from the client area, which signs you in automatically: go to Services, select your server, then select Open Cloud Console. If a popup blocker stops it, use the Open in this window link beneath the button.

On the Cloud Console dashboard, check the Account panel. If two-factor authentication shows OFF, turn it on now: this console can rebuild and destroy servers. The Recently Completed Tasks list records every action on your servers, so look there whenever something does not appear to have worked.

More in The WebGee Cloud Console.

Create your SSH key first

Key authentication is more convenient and far more secure than a password: there is nothing to guess, and the private key never leaves your machine. If you do not have a key yet, create one locally:

In the Cloud Console, open SSH Keys and select Add Key. Give it a Name that identifies the machine it belongs to, paste the public key, and select Save.

If you cannot generate a key locally, the console can do it with Generate Key Pair. Choose ED25519 and the OpenSSH format unless you use PuTTY. The private key is displayed once and never stored, so save it to ~/.ssh/ and run chmod 600 on it before closing the dialog. See Add an SSH key.

Install the operating system

1. Set the Server Name, Server Hostname and Server Timezone. Use a fully qualified hostname such as server1.example.com; mail software behaves badly with a bare hostname, and changing it later means reissuing certificates.
2. Choose an operating system template. Families include AlmaLinux, Rocky Linux, CentOS, Debian, Ubuntu, Fedora, Alpine Linux, FreeBSD and images with a hosting control panel preinstalled. Prefer an LTS release, because it receives security updates for far longer.
3. Attach your SSH key.
4. Select Install, then confirm.

Installation usually completes in under 20 seconds, and you land on the server dashboard showing its IP address. Full steps are in Set up your cloud server.

Log in and secure the basics

Connect as root using the IP address from the dashboard:

With a key attached, you are let straight in. Without one, the root password arrives by email in plain text, so change it straight away with passwd. Then:

1. Update the system: apt update && apt upgrade on Debian or Ubuntu, dnf upgrade on AlmaLinux or Rocky.
2. Add further keys to a running server by appending the public key to ~/.ssh/authorized_keys. See Connect over SSH.

If the connection times out, installation may still be finishing, so check the dashboard. If you get Permission denied, you are using the wrong key or the password email has not arrived yet; check your spam folder.

Set reverse DNS before sending email

Reverse DNS maps your IP address back to a hostname. Most receiving mail servers reject or heavily penalise mail from an IP without it, and it is the single most common reason mail from a new server goes nowhere.

1. In the Cloud Console, open the server's Network tab.
2. Select Reverse DNS beside the IP address.
3. Set it to the server's fully qualified hostname, such as mail.example.com.
4. Create a matching forward A record pointing that hostname at the same IP. The two must agree.

Check it from any machine. The first command should return your hostname and the second your IP; propagation can take a few hours.

The Network tab also lists each address's gateway, netmask and resolvers, which you need if you ever configure networking by hand. The default DNS resolvers are Cloudflare's 1.1.1.1 and 1.0.0.1; leave them unless you have a reason to change them. See Networking and reverse DNS.

Take your first backup

Back up now, while the server is clean. Open the Backups tab and select Create Backup Now. For a backup you intend to restore, power the server down first: a backup of a running server captures the disk mid-write, which can leave a database inconsistent.

Then select Schedule, choose Daily or Weekly, pick a quiet hour and select Update. Keep these limits in mind:

• A backup copies the primary disk only. Additional attached storage is not included.
• You have 6 backup slots. Once all six are used, the oldest is replaced.
• Restoring overwrites the current primary disk, and anything written since the backup is lost.
• These backups live on WebGee infrastructure alongside the server. Keep a copy elsewhere for anything you cannot afford to lose.

Details in Back up your server.

After a rebuild your SSH client reports a changed host key; clear it with ssh-keygen -R and the server IP. See Rebuild your server.

Know how to get back in

Lock-outs happen, usually through a firewall rule or an SSH configuration change. Everything you need is under Options in the Cloud Console:

• Password: if SSH refuses your password or key, select Reset Password and choose root (or Administrator on Windows). The server usually needs to be powered off and is restarted as part of the reset, so expect a brief outage. See Reset the root password.
• VNC: if the server boots but SSH does not respond, select Enable VNC Access, then Browser VNC. It gives you the server's screen and keyboard and does not depend on the network stack or SSH. VNC is unencrypted, so use it to diagnose and select Disable VNC Access when you finish.
• Rescue: if the server does not boot at all, start rescue mode, connect with the rescue credentials shown, and mount your disk, for example mount /dev/vda1 /mnt. Rescue mode changes nothing unless you do.

See Rescue mode and VNC.

Decide who looks after the server

WebGee cloud servers are unmanaged by default. WebGee provides network uptime and connectivity, the physical and virtualisation infrastructure, and the Cloud Console. Everything inside the server is yours: the operating system, its updates, security hardening, your software and its configuration. On an unmanaged server, nobody applies security updates but you.

The managed plan adds 24/7/365 technical support for the server, operating system updates, security hardening, optional proactive monitoring of services and up to 3 hours of technical assistance or consultation a month. Choose it if the server matters and nobody on your side owns its upkeep.

Either way, backups, reverse DNS and SSH keys remain yours to set up. See What server management includes.