Terug naar de blog
A server with a public IP address starts receiving login attempts a few minutes after it boots. Nothing personal: bots scan the internet non-stop, looking for weak passwords and outdated software. The security of the operating system and of what runs on it is in your hands, so do it straight away, before you install anything else.
Keep the panel's VNC console at hand: it works even if you lock yourself out of SSH, so you can always fix a mistake.
1. Update the system
apt update && apt full-upgrade -y # Debian / Ubuntu
dnf upgrade -y # AlmaLinux / Rocky / Fedora
Then turn on automatic security updates: unattended-upgrades on Debian and Ubuntu, dnf-automatic on the RHEL family.
2. Create a normal user
Working as root all the time means a single mistake, or a single compromised program, has access to everything.
adduser alice
usermod -aG sudo alice # 'wheel' instead of 'sudo' on RHEL-family systems
3. Switch to SSH keys
From your computer, copy your public key with ssh-copy-id alice@<IP> and check that you can log in without a password. If you save keys in your panel profile, you can add them when you install or reinstall a server.
4. Turn off passwords and root logins
Only after the key login works, in /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin no
Restart SSH and test a new login in a second window before closing the one you have open.
5. Enable a firewall
Open only the ports you actually use, SSH first:
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable
On servers that offer it, the panel's Firewall tab filters traffic before it even reaches the server.
6. Block repeated attempts
fail2ban bans addresses that fail to log in too many times:
apt install fail2ban
systemctl enable --now fail2ban
And then: your account and your backups
Whoever controls your account controls your servers: turn on two-factor authentication in the client area too. And keep regular backups off the server, so even in the worst case you start again from a clean copy.
Ten minutes of work that save you from most problems. The panel's guides have the step-by-step version, Windows Server included.
