A freshly provisioned VPS comes with default configurations that prioritize accessibility over security. The root password is often emailed in plaintext, SSH password authentication is enabled, and the firewall is wide open. Attackers scan for new VPS IPs within minutes of provisioning \u2014 automated bots will attempt SSH brute-force attacks on your server within the first hour it’s online. Completing these hardening steps during your first SSH session dramatically reduces your attack surface and gives you a secure foundation for all subsequent server management.<\/p>\n\n\n\n
Password-based SSH authentication is the most common entry point for automated attacks. SSH keys use asymmetric cryptography \u2014 a private key on your local machine and a public key on the server \u2014 making brute-force attacks computationally infeasible. An Ed25519 key, generated with 100 rounds of key derivation, would take billions of years to crack with current hardware.<\/p>\n\n\n\n
From your local machine, generate an SSH key pair and copy it to your VPS:<\/p>\n\n\n\n
ssh-keygen -t ed25519 -a 100 -f ~\/.ssh\/vps_key\nssh-copy-id -i ~\/.ssh\/vps_key.pub root@YOUR_VPS_IP<\/code><\/pre>\n\n\n\nThen on the VPS, harden the SSH daemon configuration:<\/p>\n\n\n\n
sudo nano \/etc\/ssh\/sshd_config\n\n# Make these changes:\nPort 2222 # Change from default port 22\nPermitRootLogin prohibit-password # Root login with key only\nPasswordAuthentication no # Disable password auth\nPubkeyAuthentication yes # Enable key auth\nMaxAuthTries 3 # Limit auth attempts\nAllowUsers youruser # Only allow specific users\nClientAliveInterval 300 # Drop idle connections after 5 min\nClientAliveCountMax 2\n\nsudo systemctl restart sshd<\/code><\/pre>\n\n\n\nCritical:<\/strong> Before closing your current SSH session, open a second terminal window and test the new key-based login on your non-default port. Verify you can authenticate successfully before disconnecting your original session \u2014 otherwise you risk locking yourself out of the server.<\/p>\n\n\n\n2. Create a Non-Root User with Sudo<\/h2>\n\n\n\n
Operating as root full-time is dangerous \u2014 one mistyped command like rm -rf \/<\/code> or a script exploit running as root can destroy your entire filesystem. Create a regular user with sudo privileges for day-to-day administration:<\/p>\n\n\n\nsudo adduser deploy\nsudo usermod -aG sudo deploy\n\n# Copy SSH keys to the new user\nsudo mkdir -p \/home\/deploy\/.ssh\nsudo cp ~\/.ssh\/authorized_keys \/home\/deploy\/.ssh\/\nsudo chown -R deploy:deploy \/home\/deploy\/.ssh\nsudo chmod 700 \/home\/deploy\/.ssh\nsudo chmod 600 \/home\/deploy\/.ssh\/authorized_keys<\/code><\/pre>\n\n\n\nAll subsequent administration should use this user with sudo<\/code> for privileged commands. After verifying sudo access works correctly, disable root SSH login entirely by setting PermitRootLogin no<\/code> in sshd_config.<\/p>\n\n\n\n3. Configure the Firewall (UFW)<\/h2>\n\n\n\n
A default-deny firewall policy blocks all incoming traffic except the specific services you explicitly allow. UFW (Uncomplicated Firewall) provides a clean interface over iptables rules and is included by default on Ubuntu:<\/p>\n\n\n\n
# Set default policies\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\n\n# Allow essential services only\nsudo ufw allow 2222\/tcp comment 'SSH on non-default port'\nsudo ufw allow 80\/tcp comment 'HTTP'\nsudo ufw allow 443\/tcp comment 'HTTPS'\n\n# Enable the firewall\nsudo ufw --force enable\n\n# Check active rules\nsudo ufw status verbose<\/code><\/pre>\n\n\n\nOnly open ports for services you actively use. If you run a database like MySQL or PostgreSQL, bind it to localhost (127.0.0.1<\/code> in the database config file) instead of opening a firewall port \u2014 databases should never be exposed to the internet directly. Use SSH tunneling or a VPN for remote database access.<\/p>\n\n\n\n4. Install and Configure Fail2ban<\/h2>\n\n\n\n
Fail2ban monitors system log files for repeated failed authentication attempts and temporarily bans offending IP addresses using firewall rules. This stops brute-force attacks against SSH, web login pages, and other services:<\/p>\n\n\n\n
sudo apt install fail2ban\n\n# Create a local jail configuration (never edit jail.conf directly)\nsudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local\nsudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\nConfigure the SSH jail with settings appropriate for your non-default port:<\/p>\n\n\n\n
[sshd]\nenabled = true\nport = 2222\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 5\nfindtime = 10m\nbantime = 1h<\/code><\/pre>\n\n\n\nRestart Fail2ban and verify it is actively monitoring your SSH logs:<\/p>\n\n\n\n
sudo systemctl restart fail2ban\nsudo fail2ban-client status sshd<\/code><\/pre>\n\n\n\n5. Configure Automatic Security Updates<\/h2>\n\n\n\n
Unpatched software is the leading cause of server compromises. The 2024 Verizon Data Breach Investigations Report found that over 60% of breaches involved known vulnerabilities with patches available but not applied. Configure automatic installation of security updates to close these gaps without manual effort:<\/p>\n\n\n\n
sudo apt install unattended-upgrades\nsudo dpkg-reconfigure --priority=low unattended-upgrades<\/code><\/pre>\n\n\n\nSelect “Yes” when prompted to automatically install security updates. Verify the configuration at \/etc\/apt\/apt.conf.d\/20auto-upgrades<\/code>:<\/p>\n\n\n\nAPT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Unattended-Upgrade \"1\";\nAPT::Periodic::AutocleanInterval \"7\";<\/code><\/pre>\n\n\n\n6. Additional Hardening Steps<\/h2>\n\n\n\n
After the essential steps above, implement these additional security measures to further lock down your VPS:<\/p>\n\n\n\n
\n- Disable root login entirely<\/strong>: Set
PermitRootLogin no<\/code> in sshd_config after verifying sudo access works correctly<\/li>\n- Install and configure AIDE<\/strong>: The Advanced Intrusion Detection Environment monitors file integrity and alerts you to unauthorized changes in system binaries and configuration files. Initialize with
sudo aideinit<\/code><\/li>\n- Set up logwatch<\/strong>: Receive daily email summaries of log activity so you can spot unusual patterns early:
sudo apt install logwatch<\/code><\/li>\n- Audit listening services<\/strong>: Run
sudo ss -tulpn<\/code> to list all services listening on network ports. Stop and disable any you do not recognize with sudo systemctl disable --now <service><\/code><\/li>\n- Harden kernel parameters<\/strong>: Disable IP forwarding (
net.ipv4.ip_forward=0<\/code>), enable source address verification (net.ipv4.conf.all.rp_filter=1<\/code>), and restrict ICMP redirects in \/etc\/sysctl.conf<\/code><\/li>\n<\/ul>\n\n\n\nSecurity Baseline Checklist<\/h2>\n\n\n\n
Run through this checklist after every new VPS deployment to ensure no step is missed:<\/p>\n\n\n\n