5 essential steps to secure your new Linux VPS

You just bought your VPS. Great step!

VPS hosting is an excellent choice that offers you more power, freedom and control.

But, with great power comes great responsibility and that’s why you should do these 5 things to make your VPS more secure.

These are just essential steps, which means that there are always some ways to make your server more secure, but this is an excellent starting point, whether you are a professional or a newcomer.

So lets jump right into it.

1: Update system packages

This should be a no-brainer. Its always a smart move to keep your software up to date.

Since Linux comes in many flavors, I can’t cover them all. In this guide, we are working with *Linux KVM VPS* with Ubuntu 22.04 installed on it, so commands will work only on Ubuntu systems.

Procedure is more or less the same on all distributions with slight differences.

sudo apt update

sudo apt upgrade

Run these commands one after another or run them together like this:

sudo apt update && sudo apt upgrade -y

2: Create a Non-Root user with SUDO privileges

It’s recommended to avoid using root account for day to day tasks to minimize the security risk.

Don’t worry, you will still have a full control over your system, you will just have to run commands with “sudo”.

sudo adduser username

Replace “username” with desired username of your new user. It can be whatever you want.

Now let’s give it SUDO privileges.

sudo usermod -aG sudo username

And now, switch to your new SUDO account.

su - username

Make sure it’s working properly. Perform some operation that requires sudo, like “sudo apt update” for example.

3: Set up SSH Key Authentication

Do note that this step requires action on your local computer as well. In this post I’m assuming that you are running Linux at home. All this is possible on Windows too, but unfortunately that won’t be covered here. If unsure, feel free to skip this step for now as it’s better not to do it at all than leave it unfinished due some unpredictable issues.

By default, you can connect to your VPS server with a password authentication.

But the thing with passwords is that they can be easily compromised or brute-forced.

Also when password authentication is enabled, bots and hackers will celebrate all night because they can now launch annoying attacks toward your SSH port and cause you inconvenience.

To avoid all that, we will use SSH keys.

I won’t dive into explaining what is SSH key authentication or how it works, and in all seriousness, you don’t even need to know how it works, all you need to know is that they are excellent and super secure.

If you are interested in learning more, feel free to check *this page*.

Run this command on your local computer:

ssh-keygen -t rsa -b 4096

This command should work on Windows 10 and Windows 11 too without any issues.

It will generate two files, and for this to work, you will need the one with .pub extension.

That is your public key that you need to copy to your VPS. The other one is the private key, DON’T SHARE IT WITH ANYONE.

Not to complicate things, we will simply use a copy-paste method. Open that newly generated .pub file that should be located in “.ssh” directory on Linux or in “C:\Users\YourUser/.ssh” on Windows.

Copy all the content from it, but make sure you don’t make any changes to the file, just close it after that.

Now back to your Ubuntu VPS

sudo nano ~/.ssh/authorized_keys

Paste the .pub key you just copied into this file and save it.

Because we have created a new user on your VPS, you should make sure that the key is pasted into “authorized_keys” file of that new user, and not the root one.

If you paste it in the file of the root user, you won’t be able to log in to your server with a new user with these keys.

Now let’s try it out

Disconnect from your VPS and let’s try to connect again, but now, by using SSH keys.

ssh -i /path/to/private-key username@your_server_ip

• private-key is the second file, not the .pub one

If you managed to connect it means everything was done properly. Congratulations!

And now, the final touch of this step

We are going to disable root login and password authentication entirely.

Make sure that you absolutely can log in using the keys generated from above. After this is done, if the keys were not set up correctly, you won’t be able to get into your server again!

To do that, run the next command:

sudo nano /etc/ssh/sshd_config

And inside of it, find the following lines:

PasswordAuthentication yes
PermitRootLogin yes

And change “yes” to “no” on both lines like this:

PasswordAuthentication no
PermitRootLogin no

And then save(in Nano editor saving is done by pressing CTRL + O and exiting by CTRL + X).

Now restart SSH service.

sudo systemctl restart ssh

4: Firewall Configuration with UFW

UFW is an amazing and easy to use Firewall that you should definitely have on your server.

While UFW is simple, it can definitely get complex too. I’m going to suggest you the basic set up, but feel free to learn about *UFW* more and see the power of it with your own eyes.

First, let’s install it.

sudo apt install ufw

And now run the following commands one by one.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

Careful with UFW!

First 3 commands are firewall rules, and as you can see, the third command is about SSH. If by any chance you skipped that one and then enabled UFW, your SSH port will be blocked and you won’t be able to connect to your VPS again.

5: Install and Configure Fail2Ban

Fail2Ban essentially protects you against certain types of attacks by banning IPs, either permanently or temporarily.

The primary purpose of Fail2Ban is to discourage and prevent hackers from gaining unauthorized access to your system through repeated login attempts. And to be honest, it’s very good at that.

Let’s install it now.

sudo apt install fail2ban

Now let’s copy default configuration file.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

You can leave it as it is, or you can make some changes like this.

sudo nano /etc/fail2ban/jail.local

Some of the parameters you could change are:

1. bantime = 10m(How long should IP be banned from being allowed to attempt certain action/login again)
2. maxretry =5 and findtime = 10m(If someone fails to login 5 times within 10 minutes, they will be banned according to the bantime parameter)

Fail2Ban offers many other configuration options, but since we are covering only essentials here, we can’t go over all of them.

Also, in some cases, Fail2Ban may ban an IP that you don’t want banned for whatever reason, so you can learn here *how to unban IPs with Fail2Ban*.

Conclusion — Security takes time

But it’s worth it!

Never forget that as technology gets better, hackers get better too. Its an endless game of cat and mouse where nobody really wins.

The more sophisticated security methods get, the more sophisticated and SNEAKY hackers get.

While taking care of the software side is certainly important, don’t underestimate hackers ability to hack humans instead of machines.

Use 2FA and password managers. Never use same password. Be careful what you are clicking on and what you are downloading. Avoid doing serious business on public networks and more importantly, be smart.

Trust your gut and be vigilant.