Everything in this guide is meant for servers you own or rent yourself, and the security tools that ship with the image are for testing systems you are authorized to test, such as your own machines or a home lab. A Parrot Linux Cloud Edition VPS gives you a headless Parrot system that is reachable from anywhere, updates from the same repositories as your desktop, and carries the project’s tooling without a desktop environment eating RAM. This guide covers how to get the image onto a virtual private server, what to do in the first ten minutes after it boots, and the basic hardening that turns a fresh box into something you can safely leave exposed to the internet.
What Parrot Linux Cloud Edition Is (and Is Not)
Cloud Edition is the server-oriented build of Parrot OS. There is no KDE, MATE or any other graphical session; you get a console, SSH, and the same Debian 13 base, apt repositories and parrot-upgrade workflow as every other edition. It is smaller than the desktop editions and expects you to work over SSH. Compared with a plain Debian server, it comes with Parrot’s package pinning, security defaults and a selection of command-line tools already installed.
It is not a hardened appliance out of the box. A VPS is a public IP address with a root login behind it, and it starts receiving automated login attempts the moment it boots. The hardening section below is not optional.
If you have not downloaded the image yet, the Cloud Edition download page on this site explains the available formats and how to verify the checksum, and the official Parrot website is the place to fetch it from.
Three Ways to Get Parrot Onto a VPS
How you install depends on what your hosting provider allows. Look in the control panel for “custom ISO” or “upload ISO” before you decide.
Option 1: Boot the Cloud ISO Through the Provider’s Console
This is the cleanest route and works wherever the provider lets you attach your own ISO and open a VNC or web console. The flow is the same as installing on a local virtual machine, just slower because the console runs over the internet:
- Upload or link the Cloud Edition ISO in the provider’s panel and attach it to a new VPS as the boot device.
- Open the web console, boot from the ISO and choose the text installer.
- Walk through language, keyboard, hostname, a non-root user, and partitioning. Use the whole virtual disk with a single partition unless you have a reason not to; LVM is fine but adds nothing on a small VPS.
- When asked about the network, accept DHCP if the provider offers it. Many providers hand out a static IP via their own metadata instead, in which case you enter the address, netmask and gateway shown in their panel.
- Let the installer finish, detach the ISO in the panel, and reboot into the installed system.
If your provider offers a custom ISO slot but the Cloud image is larger than the slot allows, the Architect Edition is a smaller netinstall-style image that lets you pick the Cloud metapackage during installation and pull everything else from the mirror.
Option 2: Start From the Provider’s Debian 13 Image
Not every host allows custom ISOs, but nearly all of them offer a stock Debian image. Because Parrot 7 is built on Debian 13, you can install Debian from the provider’s template and then convert it by adding Parrot’s repository, keyring and metapackages. It works for a lab box, but the result is a Debian system with Parrot’s packages layered on top, and the conversion steps change between releases. Follow the project’s current documentation rather than a copied script, snapshot the VPS first, and expect to redo it from scratch if a step fails halfway.
Option 3: Run Parrot in a Container on Any Server
If what you actually want is Parrot’s tooling on a server you already have, you may not need a full install at all. The project publishes official container images, and this site’s Docker images for Parrot OS page walks through pulling and running them. You keep the provider’s hardened base image, start Parrot only when you need it, and throw the container away afterwards. For one-off tasks this is the least work and the least exposure.
First Login: The Ten-Minute Checklist
Whichever route you took, log in through the console or with the password you set during installation, then do these before anything else:
1. Update Immediately
sudo parrot-upgradeThe image on your provider’s storage was built at some point in the past; the first upgrade closes whatever has been patched since. If you are not sure why Parrot recommends parrot-upgrade over plain apt upgrade, read how to update and upgrade Parrot Linux safely once and it will make sense.
2. Create a Normal User and Give It sudo
If you installed from the ISO you already did this. If you started from a provider image that only has root, fix that now:
adduser ops
usermod -aG sudo opsUse any name you like; after the next step you will never log in as root again.
3. Install Your SSH Key and Turn Off Password Logins
On your local machine, generate a key if you do not have one (ssh-keygen -t ed25519) and copy it to the server:
ssh-copy-id ops@YOUR_SERVER_IPConfirm you can log in with the key in a second terminal before you go further. Then, on the server, tighten the SSH daemon. Parrot, like Debian 13, reads drop-in files from /etc/ssh/sshd_config.d/, so you can leave the main file alone:
sudo tee /etc/ssh/sshd_config.d/10-hardening.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
MaxAuthTries 3
EOF
sudo sshd -t && sudo systemctl restart sshsshd -t checks the configuration for syntax errors before the restart; if it prints anything, fix the file first. Keep your existing session open until you have verified a fresh key login works, so a mistake cannot lock you out.
4. Set the Hostname and Time Zone
sudo hostnamectl set-hostname parrot-lab
sudo timedatectl set-timezone UTC
timedatectlPackage signatures, TLS certificates and log timestamps all depend on correct time. If timedatectl shows System clock synchronized: no, check that systemd-timesyncd is enabled and that your provider does not block outbound NTP.
Basic Hardening for a Parrot Linux Cloud Edition VPS
With SSH locked down, the next layer is deciding what the server exposes and watching what talks to it.
Firewall: Default Deny Inbound
Parrot ships nftables and can also run ufw as a friendlier front end. On a server, a few lines are enough to start: allow SSH, allow anything you deliberately host, drop the rest.
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verboseAdd rules only for services you actually run, and remove them when the service goes away. If you would rather write nftables rules directly, or you want to understand what ufw generates under the hood, Parrot Linux firewall setup with nftables and ufw covers both.
See What Is Listening
Before and after each change, look at the open ports from the server’s own point of view:
sudo ss -tulpnAnything bound to 0.0.0.0 or [::] is reachable from the internet unless the firewall blocks it. On a fresh Cloud Edition install the list should be short; if you see a service you did not expect, find its package with dpkg -S and disable it with systemctl disable --now.
Slow Down Brute-Force Attempts
With password login disabled, SSH guessing cannot succeed, but it still fills your logs. fail2ban bans addresses after repeated failures and keeps journalctl readable:
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshdTune bantime and maxretry in a local override under /etc/fail2ban/jail.d/ rather than editing the shipped files.
Keep AppArmor On
Parrot enables AppArmor by default, and on a server there is no reason to turn it off. Confirm it is active and see which profiles are enforcing:
sudo aa-statusIf a tool you install misbehaves under a profile, put that single profile into complain mode rather than disabling the whole framework. The AppArmor documentation page on this site explains the modes and the commands.
Automatic Security Updates, With Care
On Debian servers, unattended-upgrades is the usual answer. On Parrot the recommended path is parrot-upgrade, which does more than a bare apt upgrade, so a fully automatic setup can occasionally pull a change you would rather have supervised. A reasonable middle ground is a daily apt update plus a notification, and a manual parrot-upgrade on a schedule you control. A simple systemd timer that runs apt update and mails or logs the output of apt list --upgradable is enough to make sure you never go weeks without noticing pending patches.
Snapshots and Backups
Take a provider snapshot right after you finish hardening, before you install anything experimental; it is the fastest recovery from a broken upgrade or a firewall rule that locked you out. Lab notes and captured results should be copied off the server with rsync or scp on a schedule.
Using the Security Tools Responsibly From a VPS
A Parrot VPS is a convenient place to run scans against your own lab targets or a Hack The Box and TryHackMe machine over their VPN, because it has a stable connection and stays up while your laptop sleeps. Two things change compared with working from home. First, your provider’s acceptable-use policy applies: most hosts treat unsolicited port scanning from their network as abuse and will suspend the server, so scanning anything beyond targets you own or have written permission for is both unauthorized and a quick way to lose the box. Second, anything you host on the VPS, including a vulnerable practice application such as DVWA or Metasploitable, is reachable by the whole internet unless you firewall it. Bind practice targets to localhost or a VPN interface, never to the public address.
Quick Reference
| Task | Command |
|---|---|
| Full system upgrade | sudo parrot-upgrade |
| Check SSH config before restart | sudo sshd -t |
| List listening ports | sudo ss -tulpn |
| Firewall status | sudo ufw status verbose |
| Banned IPs for SSH | sudo fail2ban-client status sshd |
| AppArmor state | sudo aa-status |
| Recent failed logins | sudo journalctl -u ssh --since today |
FAQ
How much RAM does Parrot Linux Cloud Edition need on a VPS?
Because there is no desktop, the base system is light, and a small plan is enough for SSH, updates and most command-line tools. Memory-hungry tasks such as large wordlist attacks or running vulnerable VMs inside the VPS are a different story. Check the system requirements and size the plan to the heaviest job you intend to run, not to the idle footprint.
Can I add a desktop to Cloud Edition later?
Yes; the desktop metapackages are in the same repository and can be installed with apt, and you would reach the session over VNC through an SSH tunnel. Most people are better served by a local VM for graphical work, with the VPS reserved for headless tasks.
Is Cloud Edition the same as the Security Edition without a GUI?
Not exactly. It shares the base and the repositories, but the preinstalled tool selection is trimmed to what makes sense on a server. Anything missing can be installed from the Parrot repository with apt, so the practical difference is the starting point, not what is possible.