DEV Community

Cover image for Secure a Linux VPS in 15 Minutes
Pro Gineous
Pro Gineous

Posted on Originally published at blog.progineous.com

Secure a Linux VPS in 15 Minutes

#linux #beginners #security #devops

You just got root on a fresh Ubuntu box. That is power and risk in the same login. Attackers scan new IPs within minutes. This walkthrough hardens a typical Ubuntu 22.04 or 24.04 VPS in about a quarter of an hour. It works on any honest provider. If you use Pro Gineous, the steps are the same.

Assumptions: you can SSH in as root (or with sudo), you have a second terminal ready, and you are okay restarting SSH carefully.

Minutes 0-3: update and create a user 

apt update && apt upgrade -y
adduser deploy
usermod -aG sudo deploy
Enter fullscreen mode Exit fullscreen mode

Use a real password for deploy even if you plan to disable password SSH later. Keep the root session open until key login works.

Minutes 3-6: SSH keys only

On your laptop:

ssh-copy-id deploy@YOUR_SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Confirm you can open a second SSH session as deploy before you change sshd. Then edit /etc/ssh/sshd_config (or a drop-in under /etc/ssh/sshd_config.d/):

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Enter fullscreen mode Exit fullscreen mode

Reload SSH (name varies by release):

sudo systemctl reload ssh || sudo systemctl reload sshd
Enter fullscreen mode Exit fullscreen mode

Terminal showing ssh-copy-id installing the key for user deploy, logging in as deploy, and sshd settings confirming PermitRootLogin no, PubkeyAuthentication yes and PasswordAuthentication no

If the second session still works, you are safe. Only then close the root session.

Minutes 6-8: firewall 

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose
Enter fullscreen mode Exit fullscreen mode

Terminal showing sudo ufw enable, then sudo ufw status verbose listing the active rules: OpenSSH, 80/tcp and 443/tcp allowed inbound over IPv4 and IPv6, with default deny incoming

If you use a non-default SSH port, allow that port instead of OpenSSH.

Minutes 8-10: fail2ban 

apt install -y fail2ban
systemctl enable --now fail2ban
Enter fullscreen mode Exit fullscreen mode

Default jails already watch SSH on many Ubuntu images. Check:

fail2ban-client status
fail2ban-client status sshd
Enter fullscreen mode Exit fullscreen mode

If sshd is missing, add a simple jail under /etc/fail2ban/jail.d/sshd.local:

[sshd]
enabled = true
Enter fullscreen mode Exit fullscreen mode

Then systemctl restart fail2ban.

Minutes 10-12: automatic security updates 

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
Enter fullscreen mode Exit fullscreen mode

Confirm it is active:

systemctl status unattended-upgrades --no-pager
Enter fullscreen mode Exit fullscreen mode

Terminal showing sudo fail2ban-client status sshd with banned IP addresses, followed by systemctl status unattended-upgrades reporting the service as active and running

Minutes 12-14: timezone, swap, noise 

timedatectl set-timezone UTC   # or your region
ss -tulpn
Enter fullscreen mode Exit fullscreen mode

Close ports and services you do not need. On a 1-2 GB box with no swap:

fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab
Enter fullscreen mode Exit fullscreen mode

Skip swap if your provider already gives you enough RAM or managed swap.

Minutes 14-15: snapshot and backups

  1. Take a provider snapshot now, while the box is clean and hardened.
  2. Schedule off-server backups for anything that will hold real data (database dumps, /var/www, secrets). A snapshot is not a tested restore.
  3. Write down where backups live and how you would restore them.

What this does not cover

  • Application security (WordPress plugins, dependency CVEs, auth bugs)
  • Secrets management (API keys in git, world-readable .env files)
  • Monitoring and alerting
  • DDoS or network-layer attacks beyond a basic firewall

Those are next layers. This checklist only makes a fresh VPS less of an open door.

Closing

Own the server, own the failure modes. Fifteen minutes of boring hygiene beats a weekend of incident cleanup.

If you need a server to practice on, Pro Gineous VPS plans start at $6.99/mo. Whatever provider you pick, own your domain, keep SSH locked down, and test a restore at least once.

Top comments (0)