Disclosure: I run Buran.host, a VPS hosting service. The steps below work on any Debian or Ubuntu server, no matter where it is hosted.
A new VPS is scanned by bots within minutes of getting a public IP address. Open the log of a fresh server and you will already see hundreds of failed root logins. None of this is dangerous if you spend ten minutes on setup first. Here is the short checklist I use on every new server.
1. Create a normal user
Do not work as root. Create a user and give it sudo rights:
adduser deploy
usermod -aG sudo deploy
2. Log in with a key, not a password
On your own computer, create a key (skip this if you already have one):
ssh-keygen -t ed25519 -C "my-laptop"
ssh-copy-id deploy@YOUR_SERVER_IP```
{% endraw %}
Open a second terminal and check that {% raw %}`ssh deploy@YOUR_SERVER_IP`{% endraw %} logs you in without asking for the account password. Keep the first session open until this works. It is your safety net.
## 3. Turn off root and password logins
Create the file {% raw %}`/etc/ssh/sshd_config.d/hardening.conf`{% endraw %} with these lines:
{% raw %}
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
plaintext
Check the config and reload:
sudo sshd -t && sudo systemctl reload ssh
markdown
If `sshd -t` prints nothing, the syntax is fine. Test a new login from a second terminal before closing the first one.
## 4. Enable a firewall
With UFW you allow only what you really need (open 80 and 443 only if you run a website):
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable
markdown
## 5. Add Fail2ban
Fail2ban bans IP addresses that keep failing to log in:
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
markdown
The defaults already protect SSH. Check it with `sudo fail2ban-client status sshd`.
## 6. Keep the system updated
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
Security patches then install by themselves.
## Should you change the SSH port?
Moving SSH from 22 to another port reduces log noise, but it is not real security. Keys and a firewall do the real work. If you change the port, open the new port in the firewall before you reload SSH, otherwise you lock yourself out.
## What if you lock yourself out?
It happens to everyone once. Most providers give you a web console or a rescue mode that does not depend on SSH. Before you start, find where that is in your control panel, so you know it exists.
## Summary
A normal user, key-only login, no root over SSH, a firewall and Fail2ban stop almost all automated attacks. It takes ten minutes, and you only do it once per server.
A longer version with explanations is in our guide: https://buran.host/guides/ssh-hardening
If you are looking for a server to practice on, our plans start here: https://buran.host/vps
Top comments (0)