VPS Linux Ubuntu Free
Set up an eligible Oracle Ubuntu 24.04 VM, verify SSH access and save your setup checks. You need an approved account, available capacity and unused free allowance.
On this page
Check this route before creating anything
This walkthrough uses one eligible Oracle AMD micro with Ubuntu 24.04 LTS, x86/amd64. It is a small administration and learning environment. The x86 route keeps the image and command checks consistent; it is not a claim that this is the best free machine for every application.
| Item | What to check |
|---|---|
| CPU and memory | VM.Standard.E2.1.Micro: 1/8 OCPU with the ability to use additional CPU resources, and 1 GB RAM. This is not a dedicated full core. |
| Network | One VNIC with one public IP; internet bandwidth up to 50 Mbps. Oracle separately documents up to 480 Mbps for specified private/regional paths. These are published limits, not measured speeds. |
| Location and availability | Your tenancy’s home region. In a region with multiple availability domains, E2.1.Micro is available in only one AD; switching AD is not a universal workaround. Capacity is not reserved. |
| Image and storage | An Always Free-eligible Ubuntu 24.04 amd64 platform image; this example selects a 50 GB boot volume. Existing boot/block volumes count towards the combined 200 GB home-region allowance. |
Signup approval and continued availability are not guaranteed; idle instances can be reclaimed. Arm/A1, AWS, Azure and Google need their own image, quota and network checks. Use the free programme comparison if you are still choosing, or the cost and cleanup guide to plan the complete budget.
Before you select Create
- Confirm approved account access, the intended compartment/home region and permission to manage this VM, its network and console connection.
- Match the exact image and shape to the applicable free allowance in OCI. Check remaining quota and every selected resource; trial credit covering a charge is not proof of ongoing free eligibility.
- Keep the correct private key and a protected recovery copy. Supply only its public key. Have the OCI console available independently of SSH.
- Review the public address, dedicated subnet and current workstation /32 rule. Keep the image’s essential firewall rules.
- Stop before confirmation if capacity, eligibility or a charge is unclear. Do not accept a paid substitute automatically.
Record only completed checks in the setup checklist. OpenSSH must be available on your computer; the next step has separate Bash and Windows instructions.
Create and save your SSH key before launch
Choose your computer’s terminal below. Enter a passphrase when asked. These examples refuse to reuse an existing filename; if the name is taken, choose another name and use it in every later command. If you already have the correct key for an existing instance, keep using it.
Linux, macOS or WSL
On your computer, in a Bash-compatible shell
ssh -V
setup_key=~/.ssh/oci-ubuntu-free
if [ -e "$setup_key" ] || [ -e "$setup_key.pub" ]; then
printf 'This name is already used. Choose a different key filename.
'
else
mkdir -p ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -t rsa -b 3072 -f "$setup_key" &&
chmod 600 "$setup_key" &&
cat "$setup_key.pub"
fiIf ssh or ssh-keygen is missing, install your operating system’s OpenSSH client first. Keep a WSL key in its Linux home directory rather than a shared Windows folder with different permissions.
Windows PowerShell — no WSL required
Use a normal PowerShell window for your Windows account. If either command is missing, add the OpenSSH Client Windows optional feature, reopen PowerShell and check again. An SSH server on your PC is not needed.
On your Windows computer, in PowerShell
Get-Command ssh, ssh-keygen -ErrorAction Stop
$setupKeyPath = Join-Path $env:USERPROFILE '.ssh\oci-ubuntu-free'
if ((Test-Path -LiteralPath $setupKeyPath) -or (Test-Path -LiteralPath "$setupKeyPath.pub")) {
throw 'This name is already used. Choose a different key filename.'
}
New-Item -ItemType Directory -Path (Split-Path -Parent $setupKeyPath) -Force | Out-Null
ssh-keygen -t rsa -b 3072 -f "$setupKeyPath"
if ($LASTEXITCODE -ne 0) { throw 'Key generation failed. Check the message above.' }
Get-Content -LiteralPath "$setupKeyPath.pub"Protect the private file: in File Explorer open oci-ubuntu-free → Properties → Security → Advanced. Confirm your account has access. Disable inheritance, convert inherited permissions to explicit entries, then remove entries for other users from this file only; keep your own account’s access. Save and check the permissions. Do not apply this change to the whole profile or disk.
These commands produce an OpenSSH key. If you use an existing PuTTY .ppk instead, export it as an OpenSSH private key in PuTTYgen before using ssh -i. Keep the original file; changing an extension does not convert a key.
The oci-ubuntu-free.pub file is public: supply only that file when creating the instance. The file without .pub is private: keep it securely on your computer with a protected recovery copy. Never paste it into this website.
Your user key authorizes login. The guest host key checked later authenticates the server. They are different keys.
Record the compartment, region and exact instance/volume identifiers in your own resource inventory. Use ubuntu-free-ssh only as an example name for this experiment; names alone do not uniquely identify resources.
Prepare a public subnet with restricted SSH
In Networking, create a dedicated VCN for this experiment, for example 10.20.0.0/16, and a regional public subnet, for example 10.20.1.0/24. Choose non-overlapping ranges if this network will connect to existing networks. Create and enable an internet gateway in that VCN.
In the subnet's associated route table, add destination 0.0.0.0/0 with that internet gateway as the target. The instance will also need a public IPv4 address; a route alone does not provide one.
For the subnet's security list, configure a stateful ingress rule: source CIDR = your current public IPv4 followed by /32, protocol TCP, source ports All, destination port 22. Use the address seen from the internet, not your private Wi-Fi address. Retain the needed default egress and ICMP rules.
Replace any default world-open SSH rule in this dedicated list. A narrower rule does not override another permissive rule: check every attached security list and NSG. This example adds no NSG, NAT gateway or load balancer. Update the /32 rule when your workstation's public address changes.
Create the eligible Ubuntu instance
Open Compute, Instances, Create instance in the home region. Name it ubuntu-free-ssh and select the intended compartment. Review these settings before creation:
| Setting | Selection for this walkthrough |
|---|---|
| Image | Eligible Canonical Ubuntu 24.04 LTS platform image for x86/amd64 |
| Shape | VM.Standard.E2.1.Micro, AMD, 1 GB RAM |
| Boot volume | 50 GB; keep eligible performance settings and check unused allowance |
| Network | The dedicated public subnet and an assigned public IPv4 address |
| SSH key | Upload the oci-ubuntu-free.pub public key |
| Extras | No extra volumes, paid image software or optional managed services |
Oracle documents 200 GB of combined Always Free boot/block storage in the home region. Count existing volumes too. Check every resource's eligibility and the estimate; trial credit hiding a charge is not proof of ongoing free coverage. Use the free hosting limits and billing checklist if anything is unclear.
Save the following as a local text file and upload it under Advanced options, Management, Initialization script. It enables cloud-init's console output of public host keys and fingerprints for the next check; it contains no private key.
#cloud-config
ssh:
emit_keys_to_console: trueCreate the instance only after reviewing the settings. If eligible capacity is unavailable, stop and reconsider rather than selecting a paid substitute by mistake. When Running, record the instance OCID, boot-volume OCID and public IPv4 from its details.
Verify the guest host key through OCI console history
Before accepting the first SSH prompt, sign in to the OCI Console and open this exact instance. Under OS Management or Resources, open Console connection and choose Launch Cloud Shell connection. This creates the connection required for capturing console history; account permissions are required.
Open Console history, then View current history, and save or download the first-boot output. Find the SSH HOST KEY FINGERPRINTS section produced by cloud-init. Record the SHA256 fingerprint and key type of the guest host key. Do not confuse it with the fingerprints of authorized user keys.
The fingerprint shown on the Console connection resource authenticates OCI's console endpoint, not the guest's ordinary SSH endpoint. For the next step, use the guest host-key record from its boot output. If that record is missing, use OCI's documented console recovery process before proceeding; do not substitute an unverified ssh-keyscan result.
Connect from your computer and inspect Ubuntu
Replace 203.0.113.20 with the public IPv4 shown for this exact instance in OCI. The example address is reserved for documentation. Use the private key created earlier; adjust the filename if you changed it.
Connect from Linux, macOS or WSL
On your computer
ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=ask -i ~/.ssh/oci-ubuntu-free ubuntu@203.0.113.20Connect from Windows PowerShell
On your Windows computer
ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=ask -i "$env:USERPROFILE\.ssh\oci-ubuntu-free" ubuntu@203.0.113.20Compare the prompt’s key type and SHA256 fingerprint with the trusted guest boot record. Accept only a match. For this Ubuntu platform image, the login is ubuntu, not opc. A key passphrase unlocks your local key; it is not the server’s account password.
Read the result, not just the command
Run these on the VPS after verifying its host key. The expected values below describe this walkthrough; they are not measurements from a server we provisioned.
On the VPS, after verified SSH login
cloud-init status --wait --long
printf 'cloud-init exit code: %s\n' "$?"Wait for provisioning to finish before installing packages. If it remains running, interrupt the wait with Ctrl+C and use the provisioning checks; interrupting the wait does not stop cloud-init itself. Read both the status and its reported errors.
| Result | Meaning | Next action |
|---|---|---|
| Finished; code 0 | No error reported by cloud-init. | Continue with the identity and resource checks. |
| Code 2 | Finished with recoverable errors. | Read errors and recoverable_errors; investigate before marking provisioning checked. |
| Code 1, still running, or disabled | Failure, unfinished provisioning or an unexpected image state. | Keep this check unresolved and inspect the logs. Do not rerun cloud-init or rebuild automatically. |
On the VPS, after verified SSH login
cat /etc/os-release
dpkg --print-architecture
free -h
df -h /
sudo ss -lntp
sudo iptables -S| Check | Expected meaning | If it differs |
|---|---|---|
| OS and architecture | ID=ubuntu, VERSION_ID="24.04" and amd64. | Recheck the image and shape in OCI. An Arm image needs a different software compatibility check. |
Memory: free -h | The guest reports usable memory; available is the useful headroom figure. The plan’s 1 GB is not an exact expected display value. | Review running services before installing more software. This is not a capacity benchmark. |
Disk: df -h / | The root filesystem has free space. Its size can differ from the allocated boot-volume capacity. | Compare the filesystem with the selected volume in OCI; investigate a mismatch before resizing. |
SSH listener: ss | Port 22 has a listener reachable through the intended network interface. Ubuntu may use socket activation. | Use Connection refused checks. A listening port alone does not prove public reachability. |
Firewall: iptables -S | Inspect the rules without changing them; preserve the OCI image’s supplied rules. | Do not flush rules or enable UFW. Match the guest policy with the OCI network rules. |
Access check: keep your first session open and make a second SSH connection from your computer. After any required reboot, reconnect again and repeat these checks. Record the outcome in the setup checklist. Successful SSH does not prove HTTP access, software capacity or a working backup.
Update the fresh server without replacing its firewall
After cloud-init completes successfully, refresh package information and review the upgrade before confirming:
sudo apt update
sudo apt upgradeKeep the original session open and verify a second SSH login. If updates require a reboot, run sudo reboot while the server is still disposable, then reconnect and repeat the basic checks. A reboot disconnects SSH deliberately.
Do not install or enable UFW on this OCI Ubuntu image. Oracle and Canonical document conflicts with the image's persistent firewall configuration and essential iSCSI rules. Preserve those rules. An eventual website needs both OCI network permissions and compatible guest rules for its ports.
Find the check that matches your SSH error
Start with the exact message. Check the public IP against this instance’s OCID in OCI. Keep any working session open. The steps below inspect the problem; they do not reset access or firewall rules.
Connection timed out
Check in OCI: the instance is Running, has a public IPv4, and belongs to the intended public subnet. Check the route to an enabled internet gateway and TCP 22 ingress from your current public IPv4/32. Check every attached security list and NSG; their allow rules combine.
On your computer: a VPN, network change or corporate firewall can change or block this path. Update the source /32 only after confirming your current address; do not open SSH to everyone as a test.
Windows PowerShell: replace the example IP
Test-NetConnection -ComputerName 203.0.113.20 -Port 22TcpTestSucceeded: True confirms a TCP connection, not the server’s identity or successful SSH authentication. If it is false, continue checking the route and filtering. On Linux/macOS/WSL, use the SSH command below with -v -o ConnectTimeout=10 to see where it stops.
Connection refused
Something rejected this TCP connection. Confirm the IP and port first; a wrong address or a firewall rejection can look like a missing SSH listener.
In an already authenticated guest console or a working SSH session:
On the guest, only through access you already trust
sudo ss -lntp
sudo systemctl status ssh.socket ssh.service --no-pager
sudo journalctl -u ssh.socket -u ssh.service -n 40 --no-pagerLook for a port 22 listener and service errors. An inactive ssh.service alone does not prove SSH is unavailable when ssh.socket is listening. If there is no listener, resolve the reported configuration error before restarting anything. If there is one, return to the address and filtering checks.
Permission denied (publickey) or too many authentication failures
Use ubuntu for this Ubuntu platform image and the private key paired with the public key supplied at creation. A file ending in .pub is not the login identity file. Select the key explicitly to avoid unrelated keys from your agent:
Linux/macOS/WSL: replace the example IP
ssh -v -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=ask -i ~/.ssh/oci-ubuntu-free ubuntu@203.0.113.20Windows PowerShell: replace the example IP
ssh -v -o ConnectTimeout=10 -o IdentitiesOnly=yes -o StrictHostKeyChecking=ask -i "$env:USERPROFILE\.ssh\oci-ubuntu-free" ubuntu@203.0.113.20The verbose output identifies the offered key and whether the server accepts it. Confirm that key belongs to this instance. Do not publish the full log; it can reveal usernames, IPs and local paths. If the correct key is rejected, inspect authorized_keys and its ownership through working trusted guest access using the SSH troubleshooting guide. Adding a key to an account-wide key list is not proof it was installed in an existing guest.
If the private key is lost, the public key cannot recreate it. Use an existing authenticated session or an approved recovery route to install a replacement. With neither, stop and plan recovery; do not delete an instance containing data just to try another key.
Identity file not accessible, invalid format or permissions too open
On your computer: check the exact private-file path and quote paths containing spaces. Do not use the .pub file or paste key contents into a command. For an OpenSSH client, a PuTTY .ppk key needs export to OpenSSH format in PuTTYgen; renaming the extension does not convert it.
For a permissions error, apply the OS-specific private-file permissions in the key preparation step. A missing file or wrong format is not fixed by changing the server firewall.
Host key changed, does not match, or is missing from the boot record
Do not accept the connection. Check the instance OCID and current public IP, then compare the same guest-key type and SHA256 fingerprint from trusted OCI boot output. A rebuilt guest or reassigned IP can change the key; an unexplained change is still unresolved.
If first boot is still running, let it finish and capture current console history again. If you already have an authenticated guest console, you can inspect the corresponding public host-key file there. For example, for an ED25519 prompt:
In an already authenticated guest console, not your workstation or the Cloud Shell host
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubCloud Shell’s serial connection does not automatically log you into Ubuntu. If you cannot obtain a trusted guest record, stop and arrange console recovery. The console endpoint fingerprint, user-key fingerprint and an unverified ssh-keyscan result are not replacements. Remove only a confirmed obsolete known_hosts entry after authenticating the replacement; never clear the whole file.
Cloud-init has not finished, or provisioning/package commands fail
On the VPS, after verified SSH login
cloud-init status --long
sudo tail -n 60 /var/log/cloud-init.log
sudo tail -n 60 /var/log/cloud-init-output.logFind the failed stage and error before retrying. If a package task is still active, wait rather than deleting lock files. Repository connection failures need working DNS and egress; a disk-full error needs a storage check. Code 2 can mean provisioning finished with recoverable errors, so a finished state alone is not a clean result.
Keep logs private. Do not run cloud-init clean, rerun initialization or replace firewall packages as a general repair. If SSH is unavailable, start with the OCI console history and resolve guest access first.
For deeper checks, continue with the full SSH diagnosis. Keep the relevant item marked as a problem in your setup record until a fresh connection succeeds.
Keep your setup result
Mark only what you have checked. Use the review links to return to a step. This checklist records your answers; it does not connect to OCI or inspect the VPS. Do not enter keys, passwords or full logs.
0 checked · 0 with a problem · 8 not checked. These are your recorded results, not an inspection of your server.
Nothing is saved until you choose Save on this device or download TXT. Browser saving stays on this device; it does not sync between browsers.
Finished using the VM? The separate resource and cleanup record tracks what remains in the cloud and its possible costs.
Choose your next step after SSH
- Learn Linux: work through your administration tasks once the checks pass. Keep rebuild notes and copies of anything you need outside the VM.
- Publish a static website: follow the Ubuntu deployment walkthrough and choose its Oracle route. Preserve the OCI image firewall; SSH access alone does not open HTTP or HTTPS.
- Install an application: check its published OS, architecture and resource requirements first. This 1 GB setup guide does not establish application capacity.
- Finish the experiment: export your work and follow scoped cleanup. Track remaining resources in the cost and cleanup record.
Keep a recovery copy or remove this named experiment
Before relying on the VPS, store application data and rebuild notes outside it and test restoration. Keep important work recoverable if the free instance disappears. These checks establish administrative access, not production readiness.
When the instance holds website files, practise restoring a file backup on a separate computer. This verifies the selected files; it does not replace recovery planning for other application data.
When finished, export anything required. In the recorded compartment, select the exact ubuntu-free-ssh instance by OCID and choose Terminate. Its boot volume is retained by default; select permanent boot-volume deletion only if that specific volume is no longer needed and the export is verified.
Review retained volumes, backups, addresses and console connections against your inventory. Remove the dedicated subnet and gateway only after confirming nothing else uses them. Never apply account-wide deletion to tidy one experiment. Recheck remaining resources and usage afterwards.
Setup questions
Is this a public VPS or a local Ubuntu VM?
It is a provider-hosted VM with a public address. SSH access is intentionally restricted to your workstation's public IP. It does not depend on keeping your own computer running.
What if the free shape is unavailable?
Wait or reassess another documented programme. Do not assume another shape, region or larger allocation qualifies. The comparison guide explains alternatives without guaranteeing account approval or capacity.
Can I use Windows without WSL?
Yes. Use the native PowerShell instructions with the Windows OpenSSH Client. Select your private key with its full path; upload only the matching public key to OCI.
Does a successful SSH login mean my website is ready?
No. It verifies administrative access from that client. A website still needs a configured service, its own network and guest firewall permissions, HTTPS and a recovery plan.
Documentation and scope
Provider and software documentation reviewed on . This is a documented Oracle AMD micro setup route, not a provisioned-account test or a guarantee of free capacity. The checklist stores your own results.
- Oracle Always Free resources
- Oracle platform images and essential firewall rules
- Creating an Oracle Compute instance
- Oracle SSH key pairs
- Oracle public subnet scenario
- Oracle internet gateway routing
- Oracle security rules
- Oracle console connections and Cloud Shell
- Capturing Oracle instance console history
- Cloud-init Keys to Console module
- Connecting to an OCI Linux instance
- Ubuntu 24.04 release notes: Oracle firewall compatibility
- Terminating an Oracle instance
Additional references: Microsoft OpenSSH Client installation; cloud-init status and exit codes; OpenSSH client configuration. Use the exact image and account conditions shown in your console before creating resources.