A fresh VPS is exposed to the internet with minimal security. Here are the essential steps to secure it before hosting any applications.
Keep the System Updated
Install updates immediately and regularly:
apt update && apt upgrade -y\n# Enable automatic security updates\napt install unattended-upgrades -y\ndpkg-reconfigure unattended-upgradesHarden SSH
Edit /etc/ssh/sshd_config:
PermitRootLogin no\nPasswordAuthentication no\nMaxAuthTries 3\nPort 2222 # Optional: change default SSH portRestart SSH: systemctl restart sshd. Ensure SSH key auth is working before disabling passwords.
Configure a Firewall
Use UFW to allow only required ports. At minimum, allow SSH, HTTP, and HTTPS. Block everything else. See the UFW configuration guide for detailed steps.
Install Fail2Ban
Fail2Ban monitors logs and bans IPs with too many failed login attempts:
apt install fail2ban -y\nsystemctl enable fail2ban\nsystemctl start fail2banDefault configuration bans IPs after 5 failed SSH attempts for 10 minutes.