A newly provisioned VPS is like an empty house with the door unlocked - bots scan the internet constantly and will find it within hours. Securing your VPS from day one takes about fifteen minutes and prevents almost every common attack. Here is the hardening checklist.

Table of Contents

Immediate Steps

  1. Update everything: sudo apt update && sudo apt upgrade.
  2. Create a normal user for daily work: sudo adduser yourname.
  3. Give that user sudo: sudo usermod -aG sudo yourname.

Secure SSH Access

  1. Set up SSH keys on your machine and copy them to the server.
  2. Disable password login: set PasswordAuthentication no in /etc/ssh/sshd_config.
  3. Disable root login over SSH: PermitRootLogin no.
  4. Restart SSH and test from a new connection before disconnecting.

Firewall and Protections

  • Enable UFW (or iptables) and allow only needed ports: 22 (SSH), 80 (HTTP), 443 (HTTPS).
  • Install fail2ban to block repeated failed logins.
  • Keep the OS and all software updated weekly.

Users and Permissions

  • Never run daily work as root.
  • Use separate users for separate apps.
  • Set sensible file permissions and ownership.
  • Remove or disable unused accounts.

Monitoring

  • Review authentication logs (/var/log/auth.log) for failed logins.
  • Use top/htop to watch for unusual activity.
  • Take snapshots before changes - roll back if something breaks.

Frequently Asked Questions

Do I need a control panel on my VPS?

No - but panels like cPanel, CyberPanel or Webmin simplify management for beginners. Many providers offer one-click panel installation.

What is fail2ban?

A tool that watches login logs and automatically blocks IPs after repeated failures - stopping brute-force attacks in their tracks.

Secure your VPS in the first hour and you remove yourself from 99% of attack traffic. Take the snapshot, run the checklist, and sleep soundly.