Install DirectAdmin on a VPS: requirements, commands and first steps

Installing DirectAdmin on a VPS comes down to one command, once the groundwork is right. You need a fresh, supported Linux install (such as AlmaLinux or Rocky Linux 9 or 10, Debian 12 or 13, or Ubuntu 24.04), at least 4 GB of RAM plus 4 GB of swap, a static IPv4 address, root SSH access and an active DirectAdmin licence. Then you run DirectAdmin's official setup script with your licence key, log in on port 2222, and spend another half hour on firewall, SSL, backups and your first website. This guide walks through all of it, with the commands.

A made-up example of skipping the groundwork. Imran orders the cheapest VPS he can find, 2 GB of RAM and no swap, with an operating system image his provider still offers but that is close to end of life. The installer crawls for an hour, the database service gets killed for lack of memory, and the panel half works. He rebuilds the server twice before reading the requirements page. The third attempt, on a 4 GB server with swap and a current OS, finishes cleanly.

By the end you will have a working DirectAdmin server, a first site with HTTPS, and a checklist for keeping it healthy.

Is a self-managed DirectAdmin VPS right for you?

DirectAdmin gives you a full hosting control panel on your own server: websites, email, databases, DNS and backups for yourself or for clients. The trade-off is that you are now the system administrator. Security updates, backups, monitoring and fixing things at 2 am are your job, or your provider's if you buy a managed plan.

If you mostly want your website to run and do not want to look after a server, shared or managed hosting is usually the better fit. Our guide to what web hosting is compares the options.

Requirements, checked against DirectAdmin's documentation

DirectAdmin's system requirements page lists:

• Operating system: Red Hat Enterprise Linux and compatible distributions (CentOS Stream, Rocky Linux, AlmaLinux), Debian and Ubuntu, on 64-bit Intel/AMD or 64-bit ARM.
• Memory: a minimum of 4 GB of RAM, with at least 4 GB of swap.
• Disk: at least 2 GB free after the Linux install. That is the panel itself; your websites, mail, logs and backups need far more.
• Network: at least one static IPv4 address.
• System: SSH installed and working, root access, and a kernel and filesystem that support quotas.
• A clean install: DirectAdmin asks you not to install services such as Apache, PHP, MySQL, FTP or Sendmail beforehand. The installer sets these up itself.

DirectAdmin's operating system page lists the supported versions with end-of-life dates. At the time of writing:

• Do not treat the generic label “CentOS 8, 9 and 10” as one Linux line with those lifecycle dates. AlmaLinux and Rocky Linux 8/9/10 follow their own supported lifecycles; CentOS Linux 8 ended in 2021 and CentOS Stream 8 ended in 2024. CentOS Stream is a different rolling distribution, not the old CentOS Linux release. For a new installation, choose an OS version that DirectAdmin currently lists as supported and check the OS vendor's lifecycle for that exact distribution and version.
• Debian 11, 12 and 13: Debian 11 reached its OS end of life in August 2026, with DirectAdmin support ending in November 2026, so do not start a new server on it. Debian 12 runs to June 2028 and Debian 13 to June 2030.
• Ubuntu 22.04, 24.04 and 26.04 LTS: OS end of life in April 2027, April 2029 and April 2031.

For a new server, choose a release with years left: AlmaLinux or Rocky Linux 9 or 10, Debian 13, or Ubuntu 24.04 or 26.04. CentOS Linux 7 and 8, the old favourites in many tutorials, are long past end of life.

Quick tip: the quota requirement can trip up container-based VPS products. If you are unsure whether your VPS supports filesystem quotas, ask the provider before you buy.

Before you start

• An active licence key. Sign in to your DirectAdmin client account and click view next to your licence. The documentation says the licence must show as Active and Verified before you install.
• A VPS that meets the requirements, freshly installed with your chosen OS and nothing else.
• A hostname on a domain you control, such as server.example.com, with a DNS A record pointing to the VPS's IPv4 address. The installer tries to issue a certificate for this hostname automatically, which only works if the DNS is in place.
• Root SSH access, plus your provider's web console as a backup way in, in case a firewall rule locks you out.
• A snapshot or backup option from your provider, so you can return to a clean state.
• Your provider's firewall or security group settings, if it has one, so you can open the ports the panel needs.

Step 1: Connect and update the operating system

Log in as root over SSH, then bring the OS fully up to date.

On AlmaLinux, Rocky Linux or other RHEL-compatible systems:

dnf -y update
reboot

On Debian or Ubuntu:

apt update && apt -y upgrade
reboot

Reconnect after the reboot.

Step 2: Set the hostname

Set the server's hostname to the name you created the DNS record for:

hostnamectl set-hostname server.example.com
hostname -f

The second command should print the full name. Then check from your own computer that the DNS record works:

dig +short A server.example.com

It should return your VPS's IPv4 address. If not, fix the DNS record first and give it a little time.

Step 3: Check memory and add swap if needed

free -h
swapon --show

If you have less than 4 GB of swap, first run df -h / and findmnt -no FSTYPE -T / to check free space and the filesystem. Leave room for the OS, packages and site data after allocating 4 GiB. The example below is for a fresh server with a local ext4 or XFS filesystem; Btrfs, network storage and container VPSs need provider/filesystem-specific instructions. Stop if /swapfile already exists, including a symbolic link, or is already in use. Keep console access and a snapshot before changing swap or /etc/fstab.

# Bash, as root, only after the disk-space and provider checks above.
(
  set -e
  umask 077
  case "$(findmnt -n -o FSTYPE -T /)" in
    ext4|xfs) ;;
    *) echo "Use filesystem-specific swap instructions." >&2; exit 1 ;;
  esac
  if [ -e /swapfile ] || [ -L /swapfile ]; then
    echo "/swapfile already exists; do not overwrite it." >&2
    exit 1
  fi
  # Exclusive creation also refuses a file created after the check.
  (set -C; : > /swapfile)
  dd if=/dev/zero of=/swapfile bs=1M count=4096 conv=notrunc status=progress
  chmod 600 /swapfile
  mkswap /swapfile
  swapon /swapfile
  swapon --show
)

If any command fails, stop and inspect the error; do not repeat mkswap on an existing or active swap file. Confirm the new swap with swapon --show and free -h. To persist it, first back up /etc/fstab, then add /swapfile none swap sw 0 0 only if that exact path has no entry already. Have the provider review conflicting entries and verify persistence during a planned reboot with console access.

Step 4: Run the DirectAdmin installer

DirectAdmin's installation guide offers two ways. Both start the same script, downloaded from DirectAdmin's own server.

Option A: command line with your licence key

Use an interactive Bash root session on the fresh server. Enter the licence at the non-echoing prompt below rather than typing it into the command line. This avoids storing the literal key in ordinary shell history, but DirectAdmin's CLI still receives it as an argument: privileged users or monitoring may see it in the process list while it runs. Disable recording/debug tracing and use a private, trusted session. If that argument exposure is unacceptable, use the encrypted web-installer route described below. Rotate a key that was exposed; clearing history alone is not a remedy.

(
  set +x
  umask 077
  installer=$(mktemp) || exit 1
  trap 'unset DA_LICENSE_KEY; rm -f "$installer"' EXIT
  curl --proto '=https' --proto-redir '=https' -fsSL \
    https://download.directadmin.com/setup.sh -o "$installer" || exit 1
  IFS= read -r -s -p 'DirectAdmin licence key: ' DA_LICENSE_KEY || exit 1
  printf '\n'
  [ -n "$DA_LICENSE_KEY" ] || exit 1
  sh "$installer" "$DA_LICENSE_KEY"
)

Option B: web-based installer

The vendor also offers a web installer. Use it only with an encrypted SSH tunnel or a properly configured VPN that protects the entire route to the server; IP allowlisting alone does not encrypt HTTP. Keep TCP 35222 blocked from the public Internet at both firewall layers before starting. Download the script over HTTPS and run it without a licence argument:

(
  umask 077
  installer=$(mktemp) || exit 1
  trap 'rm -f "$installer"' EXIT
  curl --proto '=https' --proto-redir '=https' -fsSL \
    https://download.directadmin.com/setup.sh -o "$installer" || exit 1
  sh "$installer"
)

The installer prints an HTTP URL on port 35222 containing a secret setup token. Do not open that public-IP URL or send the token or licence across unencrypted HTTP. For an SSH tunnel, forward a loopback-only port on your own computer to the installer listener on the server, then use the local forwarded URL with the printed token. Have your provider confirm the listener and tunnel if needed; do not bypass certificate warnings or open the port publicly to make it work. Keep the token private and close the tunnel and temporary access after setup.

Optional: set details in advance

The installer accepts environment variables for common settings. DirectAdmin's predefined options page lists, among others, DA_HOSTNAME, DA_EMAIL, DA_NS1 and DA_NS2, DA_ADMIN_USER, and DA_CHANNEL (alpha, current or stable). For example:

export DA_HOSTNAME=server.example.com
export DA_EMAIL=you@example.com
export DA_NS1=ns1.example.com
export DA_NS2=ns2.example.com
# Now run Option A's prompted installer block once; do not type the key here.

By default, the installer installs CSF, attempts a hostname certificate through ACME and applies its PHP hardening defaults. Keep those defaults unless you have reviewed a specific need to change them. Set optional environment variables before the prompted installer block, not by adding a literal licence key to a command. Do not run both installation options.

The install compiles and configures a lot of software, so expect it to take a while. Keep the SSH session open until it finishes, and do not run the script a second time over a half-finished install without reading the error first.

Step 5: Log in and secure the admin account

When the installer finishes, it shows the admin login details. DirectAdmin also saves them in a file on the server:

cat /usr/local/directadmin/conf/setup.txt

Open https://server.example.com:2222 only after its valid hostname certificate is ready, and verify the hostname and certificate before entering credentials. Do not log in at a public http://server-ip:2222 address or bypass certificate warnings. If TLS is not ready, fix it through SSH/provider console or use a provider-verified encrypted tunnel. Then log in as the admin user and immediately:

• Change the admin password to a long, unique one stored in a password manager.
• Turn on two-step authentication for the admin account if your version offers it.
• Protect the setup file. Once you have stored the details safely, delete setup.txt or restrict it, since it holds the original credentials.

Step 6: Check the firewall

DirectAdmin's firewall documentation lists the ports a typical server needs open:

• 20, 21: FTP
• 22: SSH
• 25, 465, 587: outgoing and incoming mail (Exim)
• 53: DNS (named)
• 80, 443: websites
• 110, 143, 993, 995: mailboxes (Dovecot)
• 2222: the DirectAdmin panel
• 3306: MySQL, only if remote database access is needed

DirectAdmin recommends running a firewall and has direct integration with CSF. Check both layers: the firewall on the server, and any firewall or security group in your provider's control panel. Close ports for services you do not use, such as FTP if you only use SFTP.

Step 7: Create a package, a user and your first website

DirectAdmin has three levels: Admin (the whole server), Reseller (manages clients) and User (owns websites). Even if you are the only person using the server, put your websites in a normal user account rather than running them as admin.

1. Create a package at Admin or Reseller level: a template of limits such as disk space, bandwidth, domains, email accounts and databases.
2. Create a user with that package, giving the main domain, a username, an email address and a password. Menu names vary a little between DirectAdmin versions and skins; in current versions, look under the account manager section.
3. Log in as the user (or use the admin's "login as" option) and check the domain appears under the user's domain setup.

Then point the domain at the server. Either set the domain's A records at your current DNS provider to the server's IP, or use the server's own nameservers if you set them up. Our guide on connecting a domain to hosting covers both methods, and our branded nameserver guide explains glue records if you want ns1.yourdomain.com.

Step 8: Turn on free SSL for each domain

Once the domain resolves to the server, issue a Let's Encrypt certificate at User level:

1. Log in as the user and open SSL Certificates.
2. Choose the option for an automatic certificate from an ACME provider (Let's Encrypt or ZeroSSL).
3. Select the names to include: the domain, www, and mail if you use mail on this server.
4. Save. DirectAdmin's documentation says certificates are then issued and renewed automatically, checked once every 24 hours.

The domain's DNS must point to the server first, or validation fails. DirectAdmin also applies a weekly request limit to stay within Let's Encrypt's rate limits, so do not hammer the button if something is wrong; fix DNS and try again.

Then make sure the site redirects HTTP to HTTPS, as our HTTPS redirect guide explains.

Step 9: Learn the CustomBuild basics

CustomBuild is DirectAdmin's tool for managing the web server, PHP, mail, database and related software. You can use it from the panel or from the command line with da build:

da build versions
da build set php1_release 8.3
da build php
da build rewrite_confs

da build versions shows installed software and available updates. The set command changes an option in /usr/local/directadmin/custombuild/options.conf (here, the main PHP version), da build php rebuilds PHP with it, and rewrite_confs regenerates the web server configuration. Run da build help to see everything it can do, and test your sites after any rebuild.

Step 10: Backups, updates and email reputation

• Backups: set up scheduled backups of all users to a location off the server, using DirectAdmin's admin backup tools or your own system, and test a restore. Provider snapshots are a useful extra but not a replacement.
• Updates: apply OS security updates regularly (dnf update or apt upgrade), and keep DirectAdmin and the CustomBuild software current. Check da build versions after updates.
• Email: if the server will send email, ask your provider to set reverse DNS (PTR) for the IP to your hostname, and publish SPF, DKIM and DMARC records for each domain, as our email authentication guide explains. Some VPS providers block outgoing port 25 by default, so check before you promise clients working email.
• Monitoring: keep an eye on disk space, memory and the mail queue. A full disk is one of the commonest ways for a small server to fall over.

Troubleshooting

The installer says the licence is invalid

Check in your DirectAdmin client account that the licence is Active and Verified, then enter the exact key at the hidden prompt without adding quote characters. Contact DirectAdmin if the status looks wrong.

The install fails or services are killed partway through

Usually not enough memory. Confirm 4 GB of RAM and 4 GB of swap with free -h. Start again from a fresh OS install (your snapshot) rather than repeatedly re-running the script on a broken one.

The installer complains about quotas

The VPS kernel or filesystem does not support quotas, which DirectAdmin requires. Ask your provider whether quotas can be enabled, or use a VPS type that supports them.

I cannot open port 2222 in the browser

Check that DirectAdmin is running and listening, then inspect the server firewall and provider firewall using the provider console. If TCP 2222 needs an inbound rule, limit it to your trusted admin source IP or VPN rather than opening it to everyone. Also verify the hostname and TLS certificate; a browser failure is not proof of a firewall block.

The hostname certificate was not issued

The hostname's DNS record was missing or wrong at install time, or port 80 was blocked. Fix the DNS record, open ports 80 and 443, and request the hostname certificate again from the panel.

Let's Encrypt fails for a user's domain

The domain does not yet point to this server, or a CAA record does not allow the certificate authority. Check with dig +short A example.com and dig +short CAA example.com, then try again after DNS updates.

I locked myself out with the firewall

Use your provider's web console to inspect the rule that caused the lockout, then add a narrowly scoped rule for your trusted admin source IP and the required management port. Do not disable the firewall globally. CSF's broad IP allowlisting is not the same as a port-specific exception; ask the provider for the correct rule if unsure and test a second SSH session before closing the console.

The one message worth forwarding

If someone else is setting up the server, send them this:

"Please install DirectAdmin on a fresh AlmaLinux 9 or 10, Debian 13 or Ubuntu 24.04 VPS with at least 4 GB RAM and 4 GB swap, using the official setup script and our licence key. Set the hostname to server.example.com with a matching A record and reverse DNS, keep CSF enabled, open only the ports we need, enable Let's Encrypt for all domains, and set up daily off-server backups with a tested restore."

The takeaway: meet the requirements first, start from a clean supported OS, run the official script with your licence key, then lock down the panel, firewall, SSL and backups before you host anything real.