DEV Community

nikhil boghani
nikhil boghani

Posted on

The Ultimate VPS Security Guide

DevSecOps: The Ultimate VPS Security Guide
Secure your Linux VPS in the cloud with these essential practices. From SSH configuration to firewall setup, this guide covers the critical steps to fortify your server against threats.

1. Introduction to SSH

SSH (Secure Shell) is a cryptographic protocol for secure remote server management and file transfers. It’s the modern replacement for insecure protocols like Telnet.

Pro Tip💡: Use an SSH config file to manage multiple server connections efficiently.

Most OSes (Linux, macOS, Windows) include built-in SSH clients.

2. Connecting to Your VPS

Connect to your VPS using the root credentials and IP address provided by your host:

Ex:

ssh root@194.68.123.45
Enter fullscreen mode Exit fullscreen mode

First Connection: Verify the server’s fingerprint to prevent man-in-the-middle attacks. SSH stores it locally for future validation.

3. Server Hygiene: System Updates

Regular updates are your first defense against vulnerabilities.

Refresh Package Repository:

sudo apt update
Enter fullscreen mode Exit fullscreen mode

Red Hat/CentOS: sudo dnf check-update

Arch Linux: sudo pacman -Sy

Alpine: sudo apk update

Install Updates:

sudo apt upgrade -y
Enter fullscreen mode Exit fullscreen mode

Omit -y for critical systems to review updates manually.

Check Reboot Needs:

cat /var/run/reboot-required
Enter fullscreen mode Exit fullscreen mode

If present, schedule a graceful reboot:

sudo shutdown -r +5 "Server rebooting for updates in 5 minutes"
Enter fullscreen mode Exit fullscreen mode

4. Principle of Least Privilege: Standard User

❌Avoid using the root user for daily tasks to reduce risks.

Create a User:

adduser nikhil
Enter fullscreen mode Exit fullscreen mode

Set a strong, unique password.

Grant Admin Privileges:

usermod -aG sudo nikhil
Enter fullscreen mode Exit fullscreen mode

Verify:

groups nikhil
Enter fullscreen mode Exit fullscreen mode

Ensure sudo is listed.

Test Account:

ssh nikhil@194.68.123.45
Enter fullscreen mode Exit fullscreen mode 
sudo apt update
Enter fullscreen mode Exit fullscreen mode

5. Passwordless Authentication: SSH Keys

SSH keys are more secure than passwords and resist brute force attacks.

⚠️ Critical: Test SSH key authentication before disabling passwords to avoid lockout.

1.Generate Key Pair (on your local machine):

ssh-keygen -t ed25519 -C "admin@mycompany.com"
Enter fullscreen mode Exit fullscreen mode

For legacy systems:

ssh-keygen -t rsa -b 4096 -C "admin@mycompany.com"
Enter fullscreen mode Exit fullscreen mode

2.Windows SSH Agent (if applicable):

Get-Service -Name ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
Enter fullscreen mode Exit fullscreen mode

3.Add Key to Agent:

ssh-add ~/.ssh/id_ed25519
Enter fullscreen mode Exit fullscreen mode

4.Authorize Key on Server: Copy the public key:

cat ~/.ssh/id_ed25519.pub
Enter fullscreen mode Exit fullscreen mode

On the server:

 mkdir -p ~/.ssh
 chmod 700 ~/.ssh
 touch ~/.ssh/authorized_keys
 chmod 600 ~/.ssh/authorized_keys
 nano ~/.ssh/authorized_keys
Enter fullscreen mode Exit fullscreen mode

Paste the public key as a single line. Save and exit.

Alternative:

ssh-copy-id -i ~/.ssh/id_ed25519.pub nikhil@194.68.123.45
Enter fullscreen mode Exit fullscreen mode

6. Disable Password Authentication
Eliminate password-based logins to prevent brute force attacks.

⚠️ Warning: Make sure to Confirm SSH key access works in a new terminal session.

1.Edit SSH Config:

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Set:

PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

2.Check Additional Configs (e.g., AWS, DigitalOcean, Linode):

sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf
sudo nano /etc/ssh/sshd_config.d/50-linode.conf
Enter fullscreen mode Exit fullscreen mode

Ensure PasswordAuthentication no in all files.

3.Restart SSH:

sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

For CentOS: sudo systemctl restart sshd.

7. Disable Root Login

Prevent direct root access for added security.

1.Edit SSH Config:

  sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Set:

PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

Alternative: PermitRootLogin without-password for key-based root access.

2.Restart SSH:

sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

8. Setting Up a Firewall

Use UFW (Uncomplicated Firewall) to control network traffic.

1.Install UFW (if not pre-installed):

sudo apt install ufw
Enter fullscreen mode Exit fullscreen mode

2.Set Default Policies:

sudo ufw default deny incoming
sudo ufw default allow outgoing
Enter fullscreen mode Exit fullscreen mode

3.Allow SSH:

sudo ufw allow OpenSSH
Enter fullscreen mode Exit fullscreen mode

For custom ports:

sudo ufw allow 2222/tcp  # Replace with your port
Enter fullscreen mode Exit fullscreen mode

4.Enable Firewall:

sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

5.Allow Web Traffic (if hosting a website):

sudo ufw allow http
sudo ufw allow https
Enter fullscreen mode Exit fullscreen mode

6.Verify Rules:

sudo ufw status
sudo ufw show added
Enter fullscreen mode Exit fullscreen mode

🚀 Stay Secure!

Follow these steps to harden your VPS against threats. Always test configurations (especially SSH keys) before applying restrictive changes to avoid lockouts.

Thank you🙂

Top comments (0)