DEV Community

Cover image for What are the essential first-time security setup steps after logging into a new VPS?
Md Asaduzzaman
Md Asaduzzaman

Posted on

What are the essential first-time security setup steps after logging into a new VPS?

#linux #webdev #devops #programming

Essential First-Time VPS Security Setup Guide

A step-by-step checklist to secure a fresh Linux VPS (Ubuntu/Debian) immediately after creation to prevent unauthorized access and automated brute-force attacks.

📋 Security Checklist Overview

  1. Update System Packages
  2. Create a Non-Root Sudo User
  3. Transfer SSH Keys to New User
  4. Harden SSH Configuration
  5. Configure Firewall (UFW)
  6. Install & Configure Fail2Ban

🚀 Step-by-Step Instructions

1. Update System Packages

Fetch the latest package indices and upgrade existing software to patch known security vulnerabilities:

sudo apt update && sudo apt upgrade -y
Enter fullscreen mode Exit fullscreen mode

2. Create a Non-Root Sudo User

Operating as root increases the risk of accidental system damage. Create a new user with administrative privileges:

# Replace 'deploy' with your preferred username
adduser deploy
usermod -aG sudo deploy
Enter fullscreen mode Exit fullscreen mode

3. Transfer SSH Keys to New User

Copy the SSH public key from the root account to the new user's home directory so you can authenticate seamlessly:

rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
Enter fullscreen mode Exit fullscreen mode

⚠️ Note: Open a new terminal window and test logging in as deploy@<YOUR_VPS_IP> before closing your current session or changing SSH settings!

4. Harden SSH Configuration

Disable password-based authentication and root login to eliminate brute-force attack vectors:

  1. Open the SSH daemon configuration file: 
   sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode
  1. Update or verify the following directives: 
   PermitRootLogin no
   PasswordAuthentication no
   PubkeyAuthentication yes
Enter fullscreen mode Exit fullscreen mode
  1. Test configuration syntax and restart the SSH service: 
   sudo sshd -t
   sudo systemctl restart ssh
Enter fullscreen mode Exit fullscreen mode

5. Configure Firewall (UFW)

Block all incoming traffic by default, explicitly allowing only essential service ports:

# Allow SSH first to prevent lockout
sudo ufw allow OpenSSH

# Allow web traffic (if hosting web applications)
sudo ufw allow 80/tcp   # HTTP
sudo ufw allow 443/tcp  # HTTPS

# Enable firewall
sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

To check firewall status:

sudo ufw status verbose
Enter fullscreen mode Exit fullscreen mode

6. Install & Configure Fail2Ban

Automatically ban IP addresses that display suspicious activity, such as repeated failed login attempts:

# Install Fail2Ban
sudo apt install fail2ban -y

# Enable and start the service
sudo systemctl enable --now fail2ban
Enter fullscreen mode Exit fullscreen mode

To check Fail2Ban status and banned IPs:

sudo fail2ban-client status sshd
Enter fullscreen mode Exit fullscreen mode

🔒 Verification & Best Practices

  • Always test new SSH connections in a separate terminal window before terminating your active session.
  • Keep system software updated regularly or configure unattended-upgrades.
  • Consider changing the default SSH port (22) if you want to reduce scanner log clutter.

Top comments (0)