Your new VPS is exposed to the internet the moment it boots. Bots start scanning your IP within minutes, trying default passwords and known exploits. These 10 steps \u2014 ordered by priority \u2014 will lock down your server before attackers get a foothold.<\/p>\n\n\n\n
The first command on any new VPS should be a full system update. On Ubuntu or Debian run:<\/p>\n\n\n\n
sudo apt update && sudo apt upgrade -y<\/code><\/pre>\n\n\n\nOn CentOS or AlmaLinux use sudo yum update -y<\/code>. Outdated packages are the single most common entry point for attackers. Don’t skip this step even if you’re in a hurry.<\/p>\n\n\n\n2. Change the Default SSH Port<\/h2>\n\n\n\n
Port 22 is the first thing every bot checks. Edit \/etc\/ssh\/sshd_config<\/code> and change Port 22<\/code> to a high-numbered port like 2222 or 10022. Then restart SSH with sudo systemctl restart sshd<\/code>. Make sure your firewall allows the new port before disconnecting your current session.<\/p>\n\n\n\n3. Enforce SSH Key Authentication Only<\/h2>\n\n\n\n
Password-based SSH login is the #1 vulnerability on new servers. Generate a key pair on your local machine with ssh-keygen -t ed25519<\/code>, copy the public key to your server, then set PasswordAuthentication no<\/code> and PubkeyAuthentication yes<\/code> in sshd_config<\/code>.<\/p>\n\n\n\n4. Set Up a Firewall<\/h2>\n\n\n\n
UFW is the simplest firewall for Ubuntu. Allow only what you need:<\/p>\n\n\n\n
sudo ufw allow 2222\/tcp # your custom SSH port\nsudo ufw allow 80\/tcp # HTTP\nsudo ufw allow 443\/tcp # HTTPS\nsudo ufw default deny incoming\nsudo ufw --force enable<\/code><\/pre>\n\n\n\n5. Install and Configure Fail2ban<\/h2>\n\n\n\n
Fail2ban monitors authentication logs and bans IPs after repeated failures. Install it, enable the SSH jail, and set a reasonable ban time:<\/p>\n\n\n\n
sudo apt install fail2ban -y\nsudo systemctl enable fail2ban\nsudo systemctl start fail2ban<\/code><\/pre>\n\n\n\nFail2ban’s default settings work well \u2014 it bans IPs for 10 minutes after 5 failed attempts.<\/p>\n\n\n\n
6. Disable Root Login<\/h2>\n\n\n\n
Create a regular user with sudo privileges for daily work, then disable direct root login via SSH. In sshd_config<\/code> set PermitRootLogin no<\/code>. Attackers target the root account by default \u2014 removing that target dramatically reduces your risk profile.<\/p>\n\n\n\n7. Install Automatic Security Updates<\/h2>\n\n\n\n
On Ubuntu, install unattended-upgrades<\/code> to apply security patches automatically. This covers you when you’re not watching the server.<\/p>\n\n\n\nsudo apt install unattended-upgrades -y\nsudo dpkg-reconfigure --priority=low unattended-upgrades<\/code><\/pre>\n\n\n\n8. Secure Shared Memory<\/h2>\n\n\n\n