When you first get a VPS, it’s exposed to the internet within minutes. Bots will start scanning your IP almost immediately. Here are 10 essential security steps every beginner should take right after setup.
1. Update Everything
Run sudo apt update && sudo apt upgrade -y (Ubuntu/Debian) immediately. Outdated software is the #1 cause of VPS compromises.
2. Change the Default SSH Port
Edit /etc/ssh/sshd_config and change Port 22 to a custom port (e.g., 2222). This stops 99% of automated brute-force attacks.
3. Set Up SSH Key Authentication
Disable password login and use SSH keys instead. Generate a key pair with ssh-keygen, copy the public key to your server, then set PasswordAuthentication no in sshd_config.
4. Enable a Firewall
Use UFW (Ubuntu) or firewalld (CentOS). Allow only necessary ports: your custom SSH port, HTTP (80), HTTPS (443), and any application-specific ports. Deny everything else.
5. Install Fail2ban
Fail2ban monitors login attempts and bans IPs after too many failures. Install with sudo apt install fail2ban and configure it for SSH and web services.
6. Set Up Automatic Security Updates
Enable unattended-upgrades on Ubuntu: sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades.
7. Create a Non-Root User
Don’t use the root account for daily tasks. Create a user with sudo privileges: adduser username && usermod -aG sudo username. Only use root for system-level changes.
8. Harden PHP and Web Server
Disable dangerous PHP functions (exec, system, shell_exec), hide PHP version, disable directory listing in Nginx/Apache.
9. Set Up Regular Backups
Automate daily backups to offsite storage (S3, Google Drive, or another server). Test your backups monthly — a backup you never test is not a backup.
10. Monitor Logs
Check /var/log/auth.log for SSH attempts, /var/log/nginx/access.log for web traffic, and set up a monitoring tool like Netdata or UptimeRobot.
For more VPS optimization and security guides, check the features section of our main site.
Leave a Reply
You must be logged in to post a comment.