A new VPS arrives as root with a password in an email. Within a few minutes of the IP going live, scripts from all over the internet start guessing that password. None of what follows is difficult, and all of it is worth doing before you install the thing you bought the server for. Half an hour, once.
1. Update everything
apt update && apt upgrade -y && rebootLog back in after the reboot. The image the provider gave you was built weeks ago; this closes the gap.
2. Make a user that is not root
adduser deploy
usermod -aG sudo deployPick your own name instead of deploy. You will log in as this user from now on and use sudo when you need root.
3. SSH keys, then no more passwords
On your own machine, if you do not already have a key:
ssh-keygen -t ed25519 -C "[email protected]"Copy it to the server:
ssh-copy-id [email protected]Log in as deploy with the key in a second terminal to prove it works. Only then edit /etc/ssh/sshd_config on the server and set:
PasswordAuthentication no
PermitRootLogin noThen sudo systemctl restart ssh. Keep the first terminal open until the second one has reconnected successfully. Locking yourself out at this step is the classic mistake; if it happens, our console access gets you back in.
4. Firewall
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableEverything else is now closed from outside. Add ports as you need them, not in advance.
5. fail2ban
sudo apt install -y fail2ban
sudo systemctl enable --now fail2banThe default jail watches SSH and bans an IP after a few failed attempts. With password login already off this is belt and braces, which is the point.
6. Automatic security updates
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgradesAnswer yes. Security patches now install on their own. Kernel updates still need a reboot, which you can schedule in /etc/apt/apt.conf.d/50unattended-upgrades if you want it automatic.
What you have now
A server that only accepts your key, only answers on three ports, bans brute-force attempts and patches itself. Install nginx, Docker, a panel or whatever you came for. On our Cloud VPS the network side, DDoS scrubbing, was already done before you logged in; this is the half of security that is yours.
Questions we get asked
Do I need all six steps for a test server I will delete next week? Steps 1, 3 and 4 at least. A throwaway box that gets compromised is still a box sending spam from your IP.
What if I use a control panel? Plesk and cPanel manage the firewall and fail2ban for you; do steps 1 to 3 before installing the panel and let it handle the rest.
Can I keep password login on? You can, with a long password and fail2ban, but keys are easier as well as safer once set up.
Where do I put the SSH key on Windows? Windows 10 and 11 include OpenSSH; the same ssh-keygen and ssh commands work in PowerShell.
I locked myself out. Now what? Open a ticket; we have console access to every VPS and can get you back in without a reinstall.
