Essential First-Time VPS Security Setup Guide

A step-by-step checklist to secure a fresh Linux VPS (Ubuntu/Debian) immediately after creation to prevent unauthorized access and automated brute-force attacks.

📋 Security Checklist Overview

  1. Update System Packages
  2. Create a Non-Root Sudo User
  3. Transfer SSH Keys to New User
  4. Harden SSH Configuration
  5. Configure Firewall (UFW)
  6. Install & Configure Fail2Ban

🚀 Step-by-Step Instructions

1. Update System Packages

Fetch the latest package indices and upgrade existing software to patch known security vulnerabilities:

sudo apt update && sudo apt upgrade -y

2. Create a Non-Root Sudo User

Operating as root increases the risk of accidental system damage. Create a new user with administrative privileges:

# Replace 'deploy' with your preferred username adduser deploy usermod -aG sudo deploy

3. Transfer SSH Keys to New User

Copy the SSH public key from the root account to the new user's home directory so you can authenticate seamlessly:

rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

⚠️ Note: Open a new terminal window and test logging in as deploy@<YOUR_VPS_IP> before closing your current session or changing SSH settings!

4. Harden SSH Configuration

Disable password-based authentication and root login to eliminate brute-force attack vectors:

  1. Open the SSH daemon configuration file: 
 sudo nano /etc/ssh/sshd_config
  1. Update or verify the following directives: 
 PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes
  1. Test configuration syntax and restart the SSH service: 
 sudo sshd -t sudo systemctl restart ssh

5. Configure Firewall (UFW)

Block all incoming traffic by default, explicitly allowing only essential service ports:

# Allow SSH first to prevent lockout sudo ufw allow OpenSSH # Allow web traffic (if hosting web applications) sudo ufw allow 80/tcp # HTTP sudo ufw allow 443/tcp # HTTPS # Enable firewall sudo ufw enable

To check firewall status:

sudo ufw status verbose

6. Install & Configure Fail2Ban

Automatically ban IP addresses that display suspicious activity, such as repeated failed login attempts:

# Install Fail2Ban sudo apt install fail2ban -y # Enable and start the service sudo systemctl enable --now fail2ban

To check Fail2Ban status and banned IPs:

sudo fail2ban-client status sshd

🔒 Verification & Best Practices

  • Always test new SSH connections in a separate terminal window before terminating your active session.
  • Keep system software updated regularly or configure unattended-upgrades.
  • Consider changing the default SSH port (22) if you want to reduce scanner log clutter.