What this tutorial does

This tutorial shows you how to complete a DirectAdmin account setup on a fresh dedicated server or VPS you control, starting with the first SSH login and ending with a verified panel, non-root access, and basic hardening. It is aimed at hosting customers who want a clean launch path for a reseller, agency, or single-server control-panel workflow.

You will create a sudo-capable admin user, keep root access available until the new login is tested, install operating-system updates, prepare the firewall, and complete a DirectAdmin account setup with checks after each step. If you need a new server purchase, HostnExtra dedicated infrastructure is available here: https://hostnextra.com/dedicated-server.

Recommended scope: fresh server, one public IPv4 address, a registered domain, and DNS control. If you plan to use a dedicated server in the United States, Europe, Asia, or Oceania, pick the location that best matches your customer base and support workflow.

• Example placeholders used below: SERVER_IP=203.0.113.10, SSH_PORT=22, ADMIN_USER=daadmin, DOMAIN_NAME=panel.example.com, HOSTNAME=server1.example.com
• Minimum resources: a fresh dedicated server or VPS with enough RAM and disk for DirectAdmin plus your sites
• DNS required: an A record for the hostname and a domain you control for the login URL and mail records if you add email later
• Ports required: TCP 22 for SSH, TCP 2222 for DirectAdmin, TCP 80 and 443 for web and TLS

Important: keep your original root SSH session open until the non-root account works from a second terminal. Do not close the working session early.

Connect, identify the OS, and create a sudo admin user

Local computer: open a terminal and connect with SSH. If your provider uses a custom SSH port, replace 22 with that port.

ssh [email protected]

This logs in as root so you can handle the first-server tasks. If SSH uses a custom port, use:

ssh -p 2222 [email protected]

After login, run the operating-system check first. Package names, sudo groups, firewall tools, and SELinux handling vary by family.

cat /etc/os-release

Confirm whether the server is Ubuntu/Debian-family or AlmaLinux/Rocky Linux-family before continuing.

VPS as root: create the non-root admin account. Replace daadmin with your own admin username.

useradd -m -s /bin/bash daadmin
passwd daadmin

This creates the account and sets a password for emergency login. Use SSH keys for normal access. Next, grant sudo access.

Ubuntu/Debian family:

usermod -aG sudo daadmin

AlmaLinux/Rocky Linux family:

usermod -aG wheel daadmin

Now create the SSH directory and authorized keys file for the new user.

mkdir -p /home/daadmin/.ssh
chmod 700 /home/daadmin/.ssh
touch /home/daadmin/.ssh/authorized_keys
chmod 600 /home/daadmin/.ssh/authorized_keys
chown -R daadmin:daadmin /home/daadmin/.ssh

This sets up the standard key-based login path. On your local computer, copy your public key into the file. If you already have a key, append its contents; if not, generate one locally first with ssh-keygen.

Local computer:

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to accept the default file location, then add a passphrase if you want extra protection. Copy the key to the server with a second terminal or paste it into /home/daadmin/.ssh/authorized_keys.

Before changing any access settings, test the new account in a second terminal. Keep the root session open.

Local computer:

ssh [email protected]

If SSH listens on a custom port:

ssh -p 2222 [email protected]

After login, confirm sudo works.

sudo -v

You should be prompted for the user password or passphrase, then return to the shell without an error. If that succeeds, the account is ready for administration.

Update the server, set hostname, and prepare network access

VPS as the named sudo user: update package metadata and install current system patches. Use sudo from the new account so you know it works.

Ubuntu/Debian family:

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y curl wget unzip ca-certificates gnupg lsb-release

AlmaLinux/Rocky Linux family:

sudo dnf -y update
sudo dnf -y install curl wget unzip ca-certificates

These commands apply system updates and install utility packages commonly needed during panel setup. Success means the package manager finishes without dependency errors.

Set the server hostname to match your public DNS plan. Replace the example values with your real domain.

sudo hostnamectl set-hostname server1.example.com
hostnamectl status

The status output should show the new static hostname. Next, map the hostname to the server IP in /etc/hosts so local lookups behave predictably.

sudo nano /etc/hosts

Add or confirm a line like this, then save and exit:

203.0.113.10 server1.example.com server1

Open a new terminal and confirm the hostname resolves locally on the server.

hostname -f

If you use a DNS provider outside the server, create matching A records there before moving on. DirectAdmin works best when the server hostname already resolves publicly.

Open the firewall and allow DirectAdmin

VPS as the named sudo user: allow SSH, web, and panel traffic before you try to reach the control panel. The exact firewall tool depends on the distribution family.

Ubuntu/Debian family with UFW:

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 2222/tcp
sudo ufw enable
sudo ufw status verbose

This enables the firewall and opens the required ports. Confirm that 22, 80, 443, and 2222 are listed as allowed.

AlmaLinux/Rocky Linux family with firewalld:

sudo dnf -y install firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

This starts firewalld, opens the needed services, and adds the DirectAdmin port. Confirm the port appears in the list output.

If SELinux is enforcing on AlmaLinux or Rocky Linux, keep it enforcing unless the installer or your support plan says otherwise. Check the current mode with:

getenforce

If the panel installer or your service paths later need SELinux changes, document them deliberately rather than disabling SELinux without a reason.

Install DirectAdmin and complete the first login

VPS as root: DirectAdmin installation methods can vary by license and deployment path, so follow the current DirectAdmin installer instructions for your server profile, then return here for the verification sequence. During the install, you normally provide the hostname, admin email, license or access details, and the web stack choices. Make sure the installer finishes without errors and creates the panel service on port 2222.

After installation, check that the panel service is active.

sudo systemctl status directadmin

Look for active (running). If the service name differs on your install, list all services and find the panel process.

systemctl list-units --type=service | grep -i direct

Now test the panel from your local computer. Replace the domain with your actual hostname or panel FQDN.

Local computer:

curl -I https://panel.example.com:2222

Expect an HTTP response or a TLS warning you can resolve once the certificate is installed. If the connection is refused, revisit firewall rules, DNS, and the service status.

Log into the panel in a browser, confirm the admin dashboard loads, and create the first hosting account if that is part of your setup plan. Use the panel interface for account creation so your customer workflow matches a real hosting launch.

Create the first hosting account and validate file ownership

Inside DirectAdmin, add a normal hosting account for a site such as site1.example.com. Choose the correct package, disk quota, and bandwidth limits for the customer or test workload. Then confirm the filesystem paths and permissions from the shell.

VPS as root or the named sudo user: check the created account home directory.

ls -ld /home/*

Look for the account directory that DirectAdmin created. If you need to inspect web content, verify the ownership and the web root location used by your chosen stack.

find /home -maxdepth 3 -type d -name public_html -o -name domains

This helps confirm that the panel created the expected directory structure. If the account is missing or the web root is wrong, revisit the panel account creation screens before proceeding.

For a quick smoke test, create a simple index page in the new account’s public web root.

sudo sh -c 'printf "
DirectAdmin setup OK
" > /home/daadmin/domains/example.com/public_html/index.html'
sudo chown -R daadmin:daadmin /home/daadmin/domains/example.com/public_html

Adjust the path to match the account DirectAdmin created. Then browse to the site from your local computer.

curl http://example.com

You should see the test page content. If DNS has not propagated yet, use the server IP with the correct Host header or test locally with your browser hosts file.

Harden the login path and keep a rollback option

After the panel and user login work, you can tighten SSH access. Do this only after confirming the second-terminal test succeeded.

VPS as root: edit the SSH daemon configuration carefully.

sudo nano /etc/ssh/sshd_config

Set or confirm the following lines, then save and exit. Do not disable root login until you know the sudo user works.

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Validate the configuration before reloading SSH.

sudo sshd -t

No output means the syntax is valid. Then reload SSH in a way that preserves current sessions.

sudo systemctl reload ssh

On some systems the service name is sshd. If reload ssh fails, use:

sudo systemctl reload sshd

Keep the root session open until you can reconnect successfully as daadmin with your key and run sudo -v again. That is your rollback protection if you make a typo.

Verification, troubleshooting, and rollback

Server-side checks:

systemctl status directadmin
ss -tulpn | grep -E ':(22|80|443|2222)\b'
journalctl -u directadmin -n 50 --no-pager

Look for the panel process listening on 2222, the web ports open, and no repeated errors in the journal. If DirectAdmin does not start, the logs usually point to missing files, license issues, or a blocked port.

Client-side checks:

curl -I http://example.com
curl -k -I https://panel.example.com:2222

The first command should return your web page or a redirect. The second should reach the panel login endpoint. If TLS is not ready yet, the -k test helps separate certificate issues from a dead service.

Rollback steps if something breaks:

sudo systemctl status sshd
sudo nano /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl reload sshd

If you lock yourself out of SSH, use the provider console or rescue access, restore the previous SSH config, and test again before closing the root session. If the firewall blocks the panel, remove the last rule you added and reload the firewall instead of deleting unrelated rules.

Reboot persistence: confirm the panel and firewall survive a restart.

sudo systemctl is-enabled directadmin
sudo reboot

After the reboot, reconnect, run systemctl status directadmin, and repeat the curl checks. If the service starts automatically and the site still loads, the setup is ready for production use.

FAQ

Can I use this same workflow on Ubuntu and AlmaLinux?
Yes, but keep the package manager, firewall, sudo group, and service-name differences separated exactly as shown above.

Why keep root SSH open after creating the admin user?
Because it gives you a safe fallback if the new account, sudo access, or SSH hardening step is not correct yet.

What should I check first if the panel does not load?
Check DNS for the hostname, firewall rules for port 2222, and systemctl status directadmin for service failures.

Where should I go next after the first account works?
Review migration, email authentication, and backup verification guidance such as SPF, DKIM, and DMARC Setup for Reliable Email Delivery, Backup Verification on Ubuntu 26.04 and AlmaLinux 10, and How to Choose a Dedicated Server in 2026.