A fresh VPS is exposed to the internet within seconds of deployment. Automated bots scan for default configurations, weak passwords, and open ports around the clock. This guide walks you through the essential security hardening steps that every production server needs - and you can complete them all in about 15 minutes.
1. Harden SSH Access
SSH is the #1 attack vector for VPS servers. Lock it down first:
# Generate an SSH key pair (on your local machine)ssh-keygen -t ed25519 -C "your@email.com"
# Copy public key to the serverssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_SERVER_IP
# Test key-based login before disabling passwordsssh -i ~/.ssh/id_ed25519 root@YOUR_SERVER_IPNow disable password authentication and root login:
# Edit SSH configsudo nano /etc/ssh/sshd_config
# Set these values:PermitRootLogin noPasswordAuthentication noPubkeyAuthentication yesMaxAuthTries 3Port 2222 # Change from default 22
# Restart SSHsudo systemctl restart sshdAlways keep an existing SSH session open while testing new SSH settings. If you lock yourself out, you'll need console access from your VPS provider.
2. Configure the Firewall
# Install and enable UFW (Ubuntu/Debian)sudo apt install ufw -y
# Default: deny all incoming, allow outgoingsudo ufw default deny incomingsudo ufw default allow outgoing
# Allow only what you needsudo ufw allow 2222/tcp comment "SSH"sudo ufw allow 80/tcp comment "HTTP"sudo ufw allow 443/tcp comment "HTTPS"
# Enable the firewallsudo ufw enablesudo ufw status verbose3. Install Fail2ban
Fail2ban automatically bans IPs that show malicious signs (failed login attempts, exploit scanning):
sudo apt install fail2ban -y
# Create local configsudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localsudo nano /etc/fail2ban/jail.local
# Set these in [sshd] section:[sshd]enabled = trueport = 2222maxretry = 3bantime = 3600findtime = 600
# Start fail2bansudo systemctl enable fail2bansudo systemctl start fail2ban
# Check banned IPssudo fail2ban-client status sshd4. Automatic Security Updates
# Install unattended-upgradessudo apt install unattended-upgrades -ysudo dpkg-reconfigure -plow unattended-upgrades
# Verify it's activesudo systemctl status unattended-upgrades5. Create a Non-Root User
# Create deploy user with sudo accesssudo adduser deploysudo usermod -aG sudo deploy
# Copy SSH keys to new usersudo mkdir -p /home/deploy/.sshsudo cp ~/.ssh/authorized_keys /home/deploy/.ssh/sudo chown -R deploy:deploy /home/deploy/.sshsudo chmod 700 /home/deploy/.sshsudo chmod 600 /home/deploy/.ssh/authorized_keys
# Test login as deploy user before disabling root6. Basic Monitoring
# Install monitoring toolssudo apt install htop iotop nethogs -y
# Check active connectionsss -tulnp
# Monitor login attemptssudo journalctl -u sshd --since "1 hour ago" | grep "Failed"
# Set up logwatch for daily email reportssudo apt install logwatch -ysudo logwatch --detail high --mailto you@email.com --range today7. Docker Security (If Applicable)
If you're running Docker containers:
# Don't run containers as root# In Dockerfile:RUN addgroup --system app && adduser --system --group appUSER app
# Limit container resourcesdocker run --memory=512m --cpus=1 --read-only your-image
# Don't expose Docker socket# NEVER mount /var/run/docker.sock in production containersQuick Checklist
- SSH key authentication only, password login disabled
- SSH on non-default port, root login disabled
- UFW firewall with only required ports open
- Fail2ban protecting SSH and web services
- Automatic security updates enabled
- Non-root user for daily operations
- Monitoring and log review in place
Every ZentisLabs server comes with full root access on Ubuntu 24.04, Ubuntu 22.04, Debian 12, CentOS Stream 9, or Windows Server 2022. Deploy one in any of 19 locations and it's ready within minutes - then run through this checklist.