Back to blog
A new VPS is reachable from the whole internet the moment it boots. Bots will try to log in within minutes, not days. Our network blocks floods, but the server itself is yours to harden. This checklist takes about fifteen minutes on Debian or Ubuntu.
1. Update everything
apt update && apt full-upgrade -y
reboot
Reboot even if nothing seems to need it: a new kernel only protects you once it is running.
2. Create a user with sudo
Working as root means every typo runs with full power. Create a personal user instead:
adduser deploy
usermod -aG sudo deploy
3. Log in with SSH keys
On your computer, generate a key if you do not have one and copy it to the server:
ssh-keygen -t ed25519 -C "laptop"
ssh-copy-id deploy@your-server-ip
Open a new terminal and check that ssh deploy@your-server-ip works before you continue. Locking yourself out is the most common mistake in this guide.
4. Turn off password and root login
Edit /etc/ssh/sshd_config (or add a file in /etc/ssh/sshd_config.d/):
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
Then apply it with systemctl reload ssh.
5. Enable a firewall
Allow only what you actually serve. For a typical web server:
ufw default deny incoming
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable
6. Ban repeated failures
fail2ban reads your logs and blocks IPs that keep failing to log in. The defaults are already sensible for SSH:
apt install -y fail2ban
systemctl enable --now fail2ban
7. Patch automatically
Security updates should not wait for you to remember them:
apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
The checklist
| Step | Done when |
|---|---|
| Updates | apt list --upgradable is empty |
| Sudo user | you can run sudo -v as that user |
| SSH keys | you log in without a password |
| Root login off | ssh root@server is refused |
| Firewall | ufw status lists only your ports |
| fail2ban | fail2ban-client status sshd shows the jail |
| Auto patches | unattended-upgrades is enabled |
If something goes wrong, the VNC console in the control panel works even when SSH does not. It is your safety net while you change these settings.
What comes next
Backups. A hardened server can still lose data to a bad deploy or a deleted folder. Snapshots from the control panel take a minute to set up and have saved more weekends than any firewall rule.
