Setting up a bare metal server for the first time

Last change on 2026-08-27 • Created on 2026-08-27 • ID: RO-E31F8

Once your bare metal server has been provisioned, you’ll have full root access and can run any software on it. This guide takes you step by step from ordering your server to your first secure login.
It covers the process that every server goes through, regardless of its intended use: logging into Robot, selecting the operating system, connecting via SSH, and setting up robust basic security.

If you’re looking for a general overview of your server’s features first, take a look at the Bare metal server overview.

Prerequisites

  • A bare metal server that you have ordered
  • Access to Robot, our management interface for Dedicated Servers
  • The login details for your server, which you will receive from us by email once it has been provisioned
  • An SSH client on your local device (this is already installed on Linux and macOS; on Windows, you can use PowerShell or PuTTY, for example)

After placing your order, it may take some time for your server to be provisioned.
As soon as it is ready for use, we will notify you by email and send you the main IP address and your login details.

Step 1: Log in to Robot

All management of your server takes place via Robot. There, you can manage, amongst other things, the operating system, the IP addresses, the Rescue System and your support enquiries.

  1. Open robot.hetzner.com in your browser
  2. Log in using your login details
  3. Select your server from the menu under Server
    • In the server view, you’ll find several tabs, for example for the hardware, the operating system and the Rescue System. You’ll use these tabs in the next steps.

Step 2: Set up the operating system

There are three ways to install an operating system on your server. Choose the option that suits your situation.

Option A: Pre-installed operating system

If you selected an operating system when placing your order, it is already installed.
You’ll find the login details in the email you received from us.
You can proceed directly to Step 3.

Option B: New installation via Robot

For servers from the Server Marketplace, only the Rescue System is pre-installed. This means you’ll need to install an operating system via Robot or the terminal in the Rescue System.
You can automatically reinstall the server at any time using one of our standard images via the Linux tab for your server in Robot.
You can find an overview at Standard Images.

If you’d like more control, for example over RAID levels or partitioning, use our installimage script from the Rescue System:

  1. Enable the Rescue System in the Rescue tab and, if you wish, store your SSH key there (this is not required for servers that only have the Rescue System)
  2. Start the server so that it boots into the Rescue System
  3. Connect via SSH to your server’s main IP address (or using the login details from the email)
  4. In the Rescue System, run the script using the command installimage and follow the wizard

You can find a detailed description at Hetzner Rescue System and Installimage.

Option C: Installing your own operating system via the KVM Console

If you wish to install your own operating system from an ISO image, use the KVM Console.
You can find details under Installing custom images.

Windows Server: For a Windows operating system, you do not connect via SSH, but via RDP (Remote Desktop).
When you log in for the first time, you must change your password. You can find out how to do this under Changing your Windows password on first login.
The following Linux steps do not apply to you.

Step 3: Connecting to the server

Once a Linux operating system has been installed, you can connect to your server via SSH. To do this, use a command line.

  1. Access your server remotely using the following command
ssh root@<your-server-ip>

Replace the section <your-server-ip> with the primary IPv4 address of your own server.

In addition to the IPv4 address, your server is also assigned an IPv6 subnet.
For further information, see IP Addresses.

  1. When connecting for the first time, confirm the server’s fingerprint

If a warning like this appears, enter yes.

The authenticity of host “<your-server-ip> (<your-server-ip>)” cannot be established.
ED25519 key fingerprint is SHA256:Jw/3FIJwpp3FIJw/3FIJw/3FppLVppmjWs.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

The fingerprint is stored locally and will be recognised automatically in future.

  1. Log in

If you set up an SSH key during installation, you will be connected automatically. Otherwise, enter the password you set when installing the operating system (see Step 2, Option B) or received via email.

Please note that passwords are not visible when entered at the command line.

Step 4: Securing the server

A server with a public IP address is accessible from the internet from the very first second. The following steps provide a solid foundation.
Carry them out before installing production services.
The examples are based on a Debian or Ubuntu system. For other distributions, the package management and individual commands will differ.

  1. Update the system
apt update && apt upgrade
  1. Install SSH tools (if your server was previously only accessible via password)
apt install openssh-server openssh-client
  1. Create a user without root privileges

For day-to-day work, you should not log in directly as root.
Instead, create your own user and add them to the sudo group.

adduser holu
usermod -aG sudo holu

Replace holu with a username of your choice.

  1. Set up SSH key authentication

Logging in via SSH key is significantly more secure than using a password. If you do not yet have a key pair, create one on your local device.
You can find further information on how this works and how to set it up at SSH.

⚠️ Do not run the following commands on the server; run them on your own computer (open a second terminal).

ssh-keygen -t ed25519

Next, transfer your public key to the server:

ssh-copy-id holu@<your-server-ip>

Then log in again to check that key-based authentication is working:

ssh holu@<your-server-ip>

Replace holu with a username of your choice.

  1. Secure your SSH access

Once key-based authentication is working, disable password authentication and direct root login. To do this, open the configuration file:

sudo nano /etc/ssh/sshd_config

Set the following values:

PermitRootLogin no
PasswordAuthentication no

Note: To save the changes and close the file, press Ctrl + X, then Y, and finally Enter.

Apply the changes by restarting the SSH service:

sudo systemctl restart ssh

Do not close your current SSH session just yet.

Instead, open a second session and check whether you can still log in. This will prevent you from accidentally locking yourself out.

  1. Set up a firewall in the operating system

A firewall restricts which ports are accessible from outside. On Debian and Ubuntu, ufw is a simple way to get started.

sudo apt install ufw

First allow SSH, then enable the firewall:

sudo ufw allow OpenSSH
sudo ufw enable

⚠️ Never enable the firewall before you have allowed SSH. Otherwise, you’ll lock yourself out of your server.
If you’re running other services on your server, you’ll need to open the relevant ports. In the following section, you’ll find instructions on how to set up the firewall at network level in Robot.

You have now completed the basic security configuration of your server.

Common next steps and further topics:

Robot Firewall

In addition to the firewall in the operating system, you can enable a network-level firewall in Robot. It filters traffic before it reaches your server.

The Robot firewall operates stateless. It does not remember whether an incoming packet belongs to an existing connection.
Without appropriate rules, this may result in return traffic from your own connections being blocked.
You should therefore configure it carefully. Details and example rules can be found under Firewall.

Support for your server

You can submit support requests directly via Robot. By logging into Robot, you confirm your identity, which is why we process requests submitted via Robot the quickest.

If, in an emergency, you wish to speak directly to our technicians at the data centre by telephone, please set up a telephone password in your Robot account beforehand.

Our technicians will ask for this password to verify your identity before they work on your server.

Table of Contents