{"id":578,"date":"2026-07-21T04:12:19","date_gmt":"2026-07-21T04:12:19","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=578"},"modified":"2026-08-16T22:13:28","modified_gmt":"2026-08-16T22:13:28","slug":"vps-security-hardening-essential-steps-after-your-first-login","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/","title":{"rendered":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A freshly provisioned VPS is not a neutral, waiting server &mdash; it is a target. Internet-wide scanners catalogue new IP ranges continuously, and automated botnets begin SSH brute-force attempts within the first hour a default-configured server comes online. The window between your first login and a successful compromise is often measured in days, sometimes hours. Everything in this article is designed to be completed during that first SSH session, in under 30 minutes, using only commands you can paste into a terminal.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Generate an SSH Key Pair and Disable Password Login<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Password authentication is the single most attacked authentication method on the public internet. An Ed25519 key with a high key-derivation round count is computationally infeasible to brute-force with current hardware, while a weak password can fall in seconds to dictionary attacks. Generate the key on your local machine, never on the server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh-keygen -t ed25519 -a 100 -f ~\/.ssh\/vps_key\nssh-copy-id -i ~\/.ssh\/vps_key.pub root@YOUR_VPS_IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now harden the SSH daemon on the server by editing <code>\/etc\/ssh\/sshd_config<\/code>:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><code>Port 2222<\/code> &mdash; move SSH off the default port to cut 99% of automated scans<\/li><li><code>PermitRootLogin prohibit-password<\/code> &mdash; root may only log in with a key<\/li><li><code>PasswordAuthentication no<\/code> &mdash; disable password auth entirely<\/li><li><code>MaxAuthTries 3<\/code> &mdash; limit authentication attempts per connection<\/li><li><code>AllowUsers deploy<\/code> &mdash; whitelist the only user allowed to log in<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Restart with <code>systemctl restart ssh<\/code>, then <strong>before closing your current session<\/strong>, open a second terminal and verify key login works on the new port. Locking yourself out is the only real risk in this step.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Create a Non-Root User With sudo<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Operating as root full-time turns every typo into a potential disaster &mdash; one misplaced <code>rm -rf<\/code> or a compromised web application running as root wipes or owns the entire server. Create a regular administrative user and copy your key over:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>adduser deploy\nusermod -aG sudo deploy\nmkdir -p \/home\/deploy\/.ssh\ncp ~\/.ssh\/authorized_keys \/home\/deploy\/.ssh\/\nchown -R deploy:deploy \/home\/deploy\/.ssh\nchmod 700 \/home\/deploy\/.ssh &amp;&amp; chmod 600 \/home\/deploy\/.ssh\/authorized_keys<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once sudo works from the new user, set <code>PermitRootLogin no<\/code> in <code>sshd_config<\/code> so root cannot log in at all.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Enable a Default-Deny Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A default-deny policy blocks every incoming connection except the handful of ports you explicitly open. UFW is the fastest way to get there on Ubuntu and Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ufw default deny incoming\nufw default allow outgoing\nufw allow 2222\/tcp comment 'SSH'\nufw allow 80\/tcp comment 'HTTP'\nufw allow 443\/tcp comment 'HTTPS'\nufw --force enable\nufw status verbose<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Port<\/th><th>Service<\/th><th>Rule<\/th><\/tr><\/thead><tbody><tr><td>2222\/tcp<\/td><td>SSH (moved from 22)<\/td><td>Allow from your IP only, if possible<\/td><\/tr><tr><td>80\/tcp<\/td><td>HTTP<\/td><td>Allow<\/td><\/tr><tr><td>443\/tcp<\/td><td>HTTPS<\/td><td>Allow<\/td><\/tr><tr><td>3306 \/ 5432<\/td><td>MySQL \/ PostgreSQL<\/td><td>Never open &mdash; bind to 127.0.0.1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Databases belong on localhost. If you need remote access, use an SSH tunnel or WireGuard instead of exposing the port to the internet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Install Fail2ban for Brute-Force Protection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban watches authentication logs and bans IP addresses that fail repeatedly. It is a second line of defence behind key-only auth, and it also protects web login pages:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install fail2ban\ncp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In <code>jail.local<\/code>, configure the SSH jail for your non-default port:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>[sshd]\nenabled = true\nport = 2222\nmaxretry = 5\nfindtime = 10m\nbantime = 1h<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify it is actually watching: <code>fail2ban-client status sshd<\/code> should show a log path and a ban count.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Enable Automatic Security Updates<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Verizon&rsquo;s Data Breach Investigations Report has repeatedly found that the majority of breaches exploit known vulnerabilities with patches that were never applied. On Ubuntu and Debian, <code>unattended-upgrades<\/code> closes that gap:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install unattended-upgrades\ndpkg-reconfigure --priority=low unattended-upgrades<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm <code>\/etc\/apt\/apt.conf.d\/20auto-upgrades<\/code> contains:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>APT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Unattended-Upgrade \"1\";<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Audit Listening Services<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most VPS images ship with services you do not need. <code>ss -tulpn<\/code> lists everything listening on a network port; anything you do not recognise should be stopped and disabled with <code>systemctl disable --now &lt;service&gt;<\/code>. Fewer open ports means fewer attack surfaces, period.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The 10-Minute Verification Checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>SSH into the new non-default port using your key &mdash; password prompt must not appear<\/li><li><code>sudo -v<\/code> works for the deploy user, and <code>PermitRootLogin no<\/code> is active<\/li><li><code>ufw status verbose<\/code> shows default deny + only your allowed ports<\/li><li><code>fail2ban-client status sshd<\/code> reports an active jail<\/li><li><code>unattended-upgrades --dry-run<\/code> completes without errors<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Beyond the First Session: File Integrity and Log Review<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once the six core steps are in place, two additions give you early warning when something does slip through. AIDE (Advanced Intrusion Detection Environment) builds a cryptographic database of system binaries and configuration files; a nightly <code>aide --check<\/code> run flags any unauthorized modification, which is how you detect a backdoored binary before it does damage. Logwatch, meanwhile, emails you a daily digest of authentication failures, service restarts, and disk warnings, so a sudden spike in failed logins is visible the next morning instead of months later.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install aide logwatch\naideinit &amp;&amp; mv \/var\/lib\/aide\/aide.db.new \/var\/lib\/aide\/aide.db\nlogwatch --output mail --mailto you@example.com --detail high<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Schedule both with cron: <code>aide --check<\/code> nightly at 03:00 and Logwatch at 06:00. On a small VPS each run costs a few megabytes of I\/O and under a minute of CPU, which is a small price for knowing that your binaries and logs are being watched.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These six steps take roughly 25 minutes on a fresh server and reduce the realistic attack surface by orders of magnitude. The same discipline applies no matter which provider you deploy on &mdash; if you are still choosing one, <a href=\"https:\/\/virtualserversvps.com\/#providers\">compare providers side by side in our VPS comparison table<\/a>, and for plan-level differences such as DDoS protection and backup offerings, <a href=\"https:\/\/virtualserversvps.com\/#features\">see the full feature breakdown on our VPS page<\/a> before you commit. A provider that offers snapshots and automated backups makes the <a href=\"https:\/\/virtualserversvps.com\/#faq\">recovery questions in our FAQ<\/a> much easier to answer later.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A freshly provisioned VPS is not a neutral, waiting server &mdash; it is a target. Internet-wide scanners catalogue new IP ranges continuously, and automated botnets begin SSH brute-force attempts within&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":1,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-578","post","type-post","status-publish","format-standard","hentry","category-vps-guides-tutorials"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.1 (Yoast SEO v26.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server - Virtual Servers VPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server\" \/>\n<meta property=\"og:description\" content=\"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Servers VPS Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-21T04:12:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-16T22:13:28+00:00\" \/>\n<meta name=\"author\" content=\"Virtual-Servers-Vps-Editor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Virtual-Servers-Vps-Editor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/\",\"name\":\"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server - Virtual Servers VPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\"},\"datePublished\":\"2026-07-21T04:12:19+00:00\",\"dateModified\":\"2026-08-16T22:13:28+00:00\",\"author\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\"},\"breadcrumb\":{\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/virtualserversvps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#website\",\"url\":\"https:\/\/virtualserversvps.com\/blog\/\",\"name\":\"Virtual Servers VPS Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0\",\"name\":\"Virtual-Servers-Vps-Editor\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g\",\"caption\":\"Virtual-Servers-Vps-Editor\"},\"sameAs\":[\"https:\/\/virtualserversvps.com\/blog\"],\"url\":\"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server - Virtual Servers VPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/","og_locale":"en_US","og_type":"article","og_title":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server","og_description":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server","og_url":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/","og_site_name":"Virtual Servers VPS Blog","article_published_time":"2026-07-21T04:12:19+00:00","article_modified_time":"2026-08-16T22:13:28+00:00","author":"Virtual-Servers-Vps-Editor","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Virtual-Servers-Vps-Editor","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/","url":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/","name":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server - Virtual Servers VPS Blog","isPartOf":{"@id":"https:\/\/virtualserversvps.com\/blog\/#website"},"datePublished":"2026-07-21T04:12:19+00:00","dateModified":"2026-08-16T22:13:28+00:00","author":{"@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0"},"breadcrumb":{"@id":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/virtualserversvps.com\/blog\/vps-security-hardening-essential-steps-after-your-first-login\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualserversvps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"VPS Security Hardening: 6 Steps for Your First SSH Session on a New Server"}]},{"@type":"WebSite","@id":"https:\/\/virtualserversvps.com\/blog\/#website","url":"https:\/\/virtualserversvps.com\/blog\/","name":"Virtual Servers VPS Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualserversvps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/82a299a8284a66ff49f97c74684724a0","name":"Virtual-Servers-Vps-Editor","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualserversvps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d820b15f1cd028e97610d9adf536df7be5cb6423869967037d468d5355fa003f?s=96&d=mm&r=g","caption":"Virtual-Servers-Vps-Editor"},"sameAs":["https:\/\/virtualserversvps.com\/blog"],"url":"https:\/\/virtualserversvps.com\/blog\/author\/virtualserversvps\/"}]}},"_links":{"self":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/comments?post=578"}],"version-history":[{"count":2,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/578\/revisions"}],"predecessor-version":[{"id":899,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/posts\/578\/revisions\/899"}],"wp:attachment":[{"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/media?parent=578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/categories?post=578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualserversvps.com\/blog\/wp-json\/wp\/v2\/tags?post=578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}