Setting Up Claude Code and ChatGPT Codex on a Linux Server: Step by Step

This guide takes you from a freshly installed Debian or Ubuntu server to a working AI agent that analyzes logs, checks configurations and performs maintenance tasks. We set up Claude Code (Anthropic) and Codex CLI (OpenAI, the command line tool behind ChatGPT), both under a dedicated user with limited rights. All commands were tested on a KernelHost KVM root server with Debian 13 and Ubuntu 24.04. What an AI managed server is in general and which architectures exist is covered in the article AI Managed Server: connecting AI agents securely.

As of September 2026. The tools evolve quickly; when in doubt, check the switches with claude --help or codex --help.

Prerequisites

• A root server with Debian 12 or 13 or Ubuntu 22.04 or 24.04 and root access via SSH. On AlmaLinux and Rocky Linux the steps are the same, only the package commands are called dnf instead of apt.
• Basic hardening done: SSH login via key, firewall, automatic security updates. The checklist for new root servers covers that.
• An account with Anthropic (Claude Pro, Max or Team) or an API key, a ChatGPT account (Plus, Pro or Team) or an OpenAI API key. You only need one of them if you only want to set up one tool.
• Outbound HTTPS to api.anthropic.com and api.openai.com. On KernelHost servers this is the case out of the box; a restrictive firewall of your own must allow it.

Step 1: Create a dedicated user and limit sudo

The agent never runs as root. It gets its own account and, via a sudo allowlist, exactly the commands it needs. Start with a few read-only commands and extend the list when a task really requires it.

sudo adduser --disabled-password --gecos "AI agent" aiagent
sudo tee /etc/sudoers.d/aiagent >/dev/null <<'EOF'
aiagent ALL=(root) NOPASSWD: /usr/bin/journalctl *, /usr/bin/systemctl status *, /usr/bin/systemctl restart nginx, /usr/bin/apt-get update, /usr/bin/apt-get upgrade -y, /usr/bin/tail *, /usr/bin/df *, /usr/bin/ss *
EOF
sudo chmod 440 /etc/sudoers.d/aiagent
sudo visudo -cf /etc/sudoers.d/aiagent

The last line checks the syntax. An error in a sudoers file can lock sudo for everyone, which is why the check always belongs there. --disabled-password ensures that nobody can log in as aiagent with a password; you switch into the account later with sudo -iu aiagent.

If the agent is supposed to change files in /etc, do not allow it nano via sudo (that would allow editing any file, including /etc/sudoers), but work with a group and targeted write permissions, for example setfacl -m u:aiagent:rw /etc/nginx/sites-available/my-site.conf. To begin with it is perfectly sufficient if the agent proposes changes and you apply them.

Step 2: Install Node.js 22

Both tools run on Node.js. Claude Code requires at least version 18, Codex CLI at least 22, so we install 22 LTS. The Debian 12 package sources ship a version that is too old; NodeSource provides the current one:

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version
npm --version

If you prefer not to run scripts from the internet with root rights, use nvm in the home directory of the agent user; that works entirely without root rights. Details and alternatives are in the guide to Node.js on Debian.

Step 3: Install Claude Code and sign in

From here on we work in the agent's account:

sudo -iu aiagent
curl -fsSL https://claude.ai/install.sh | bash
claude --version

The native installer places Claude Code under ~/.local/bin and keeps itself up to date. Alternatively use npm with npm install -g @anthropic-ai/claude-code; if that fails with EACCES, the troubleshooting section below helps.

On the first start of claude the tool asks you to sign in. With a Claude account it normally opens the browser; on a server without a browser it shows an address and a code that you confirm on a laptop or smartphone. For scripts and cron jobs an API key is the better choice:

echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.bashrc
chmod 600 ~/.bashrc
source ~/.bashrc
claude -p "Answer only with OK" 

The key then lives only in the home directory of the agent user, which other users cannot read. Create it in the Anthropic console with a monthly spending limit, then a session that gets out of hand cannot become expensive.

Step 4: Configure Claude Code for the server

On start, Claude Code reads a file CLAUDE.md in the current directory. It contains the rules that apply to every session. Create a working directory with this file in the agent's home directory:

mkdir -p ~/server && cd ~/server
cat > CLAUDE.md <<'EOF'
# Rules for this server
- This is a production server (Debian 13, nginx, PHP-FPM, MariaDB).
- Read-only commands (journalctl, systemctl status, tail, df, ss) are allowed at any time.
- Before every write command, explain briefly what it changes and wait for approval.
- Never remove packages, never delete files under /var/lib, never create or delete users.
- Never repeat passwords, keys or customer data in outputs.
- At the end of every task provide a summary in three sentences.
EOF

Add an allowlist of tools so that Claude Code runs read-only commands without asking and requests approval for everything else. The file ~/.claude/settings.json applies to the user:

mkdir -p ~/.claude
cat > ~/.claude/settings.json <<'EOF'
{
  "permissions": {
    "allow": [
      "Bash(sudo journalctl:*)",
      "Bash(sudo systemctl status:*)",
      "Bash(sudo tail:*)",
      "Bash(df:*)",
      "Bash(free:*)",
      "Bash(ss:*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(sudo rm:*)",
      "Bash(dd:*)",
      "Bash(mkfs:*)"
    ]
  }
}
EOF

Now the first task, interactively:

cd ~/server && claude
> Summarize the errors from journalctl of the last 24 hours and name the three most common causes.

And the same task unattended, for example as a daily cron job at 7 a.m. whose result arrives by email:

0 7 * * * cd /home/aiagent/server && /home/aiagent/.local/bin/claude -p "Summarize errors and warnings from journalctl of the last 24 hours. Name service, time and probable cause." --allowedTools "Bash(sudo journalctl:*)" 2>&1 | mail -s "Daily server report" admin@example.com

The switch -p starts Claude Code without an interactive session, --allowedTools limits the tools to exactly what the run needs. Write actions do not belong in unattended runs.

Step 5: Install Codex CLI (ChatGPT) and sign in

Codex CLI is the tool from OpenAI that brings the models behind ChatGPT to the command line. Installation in the same user account:

npm install -g @openai/codex
codex --version

Sign-in works with the ChatGPT account (Plus, Pro or Team): start codex, choose "Sign in with ChatGPT" and open the displayed address on a device with a browser. For scripts set an API key from the OpenAI platform instead:

echo 'export OPENAI_API_KEY="sk-..."' >> ~/.bashrc
source ~/.bashrc

Codex comes with its own sandbox and an approval mode. Both are defined in ~/.codex/config.toml; for a production server this combination makes sense:

mkdir -p ~/.codex
cat > ~/.codex/config.toml <<'EOF'
approval_policy = "on-request"
sandbox_mode = "workspace-write"
EOF

workspace-write allows write access only in the current working directory, on-request makes the agent ask for permission for everything beyond that. The level danger-full-access removes both and does not belong on a production system. Codex reads rules like those in CLAUDE.md from a file AGENTS.md in the working directory; you can use the same content:

cp ~/server/CLAUDE.md ~/server/AGENTS.md
cd ~/server && codex "Check whether all enabled systemd services are running and list the failed ones with their last error message."

For unattended runs there is codex exec "task", the counterpart to claude -p.

Alternative: the agent runs on your computer and works via SSH

If you prefer not to install anything on the server, start Claude Code or Codex on the laptop and let the agent send commands via SSH. For that the server gets a dedicated SSH key of the agent user, and CLAUDE.md contains the rule to prefix all server commands with ssh aiagent@server. This works well for occasional maintenance, but longer tasks and cron jobs run better directly on the server.

Step 6: Harden and set limits

• Snapshot or backup before every session in which something is supposed to change. The backup strategy for servers shows how to automate that.
• Keep the approval mode on. --dangerously-skip-permissions in Claude Code and danger-full-access in Codex are meant for throwaway VMs.
• Secrets out of reach. The agent user must not be able to read .env files, database passwords and customer data. What it reads goes to the provider.
• Cost limit for every API key in the provider's console.
• Traceability: install etckeeper so that every change under /etc lands in Git, and keep the agent's summaries.
• Nothing changes inbound. Both tools only need outbound HTTPS. Firewall, Fail2ban and the hosting provider's DDoS protection stay unchanged.

Typical errors and solutions

Conclusion

An AI agent on the server is set up in an hour: user, sudo allowlist, Node.js, tool, rules. The real work lies in the limits, and they are deliberately tight here. Extend them step by step when a task requires it, never wholesale. On a KernelHost root server or dedicated server nothing needs to be unlocked for this: root access, free choice of distribution and outbound connections are standard.