Linux Server Security: 8 Essential Steps for a New VPS

To secure a fresh Linux server, do eight things in this order: update the system, create a regular user with sudo, log in with an SSH key, disable password login, enable a firewall, install fail2ban, turn on automatic updates and make backups. The commands below are for Ubuntu and Debian, and they neutralize most automated attacks.

Why is a new server targeted immediately?

Every public IP address on the internet is scanned constantly by automated bots, and attempts to guess SSH passwords begin within minutes. So do not leave hardening for later. Try each command on a test server first, and keep a second SSH session open before closing any login route so you do not lock yourself out.

1. Update the system

apt update && apt upgrade -y

Updates close known holes. If the kernel was updated, reboot once.

2. Create a regular user

adduser deploy
usermod -aG sudo deploy

Do daily work as this user and use sudo only when needed.

3. Log in with an SSH key

Create a key on your own computer and put it on the server (details in what SSH is):

ssh-keygen -t ed25519
ssh-copy-id deploy@IP

4. Disable password login and direct root login

Once key login works, open /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin no

Then run systemctl restart ssh. Remember to keep a second session open before you do.

5. Turn on a firewall

With ufw, open only the ports you need:

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

Open a service's ports only when you run that service. A database should never be exposed directly to the internet.

6. Install fail2ban

apt install fail2ban -y

It temporarily blocks IPs that repeatedly fail to log in. The default SSH rule is enabled.

7. Automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

8. Make backups

Security is incomplete without backups; your own mistakes also destroy data. At the very least copy important data off the server and test a restore once.

What next?

• Install only the software you need.
• Glance at /var/log/auth.log now and then.
• Keep passwords in a password manager and never reuse them.

What else should not be forgotten?

Security is not only the operating system. Applications you install yourself (such as WordPress and its plugins) are a common way in and must stay updated. Give each program and user the minimum access it needs. Use last to see recent logins and lastb for failed attempts. Investigate anything unusual, such as a login from an unknown IP or a sudden CPU spike.

A quick checklist after hardening

1. You log in as a regular user with an SSH key and password login is off.
2. ufw status shows only the ports you need.
3. systemctl status fail2ban is active.
4. Automatic updates are on.
5. You have a tested backup of important data.
6. You reviewed open ports with ss -tulpn and closed any service you do not recognize.

CloudSnap tools for this

On a CloudSnap server page you can take a snapshot (billed by the hour from your balance as long as you keep it), change the password, and, where the server supports it, reinstall the operating system; a reinstall erases all data. On servers that have a web console, it is also a way back in if SSH login gets locked. The firewall and OS hardening are up to you. To start, go to the bot or the pricing page.

FAQ

What is the most important security step?

Logging in with an SSH key and disabling password login, because most automated attacks rely on weak passwords.

Do I need to change the SSH port?

No. It reduces log noise but does not replace keys and a firewall.

What if I lock myself out?

Log in through the provider's web console and correct the setting; without a console, a reinstall means losing data.

Does fail2ban stop everything?

No. It only slows repeated login attempts and does not replace a strong password or key.

How often should I update the server?

Enable automatic security updates and run a full update by hand every few weeks.