DEV Community

Cover image for Securing a VPS: Essential Hardening Steps for Web Developers (Part 1)
Tomas Hornak
Tomas Hornak

Posted on • Edited on

Securing a VPS: Essential Hardening Steps for Web Developers (Part 1)

#security #vps #docker #linux

After working with various PaaS solutions for years, I decided to set up a VPS with Contabo for hosting a few personal projects. While nothing particularly sensitive will be hosted there, I still wanted to implement proper security practices from the start.

Even simple hobby projects can become targets for automated attacks or get compromised for cryptocurrency mining. Here's my systematic approach to hardening a fresh Ubuntu VPS, covering the essential security fundamentals.

The Starting Point

Fresh VPS with Ubuntu, an admin user with sudo privileges, and SSH key authentication already configured during setup. Time to implement proper security measures.

Step 1: SSH Hardening

The default SSH configuration needed immediate attention. Running SSH on the default port 22 makes your server a target for automated scanning tools that constantly probe this port.

sudo nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Key changes made:

Port 2222                   # Move away from the default port
PermitRootLogin no          # Disable direct root access
PasswordAuthentication no   # Enforce key-based authentication
PubkeyAuthentication yes    # Enable SSH keys
MaxAuthTries 3              # Limit failed attempts
AllowUsers admin            # Restrict user access
Enter fullscreen mode Exit fullscreen mode

Then restart SSHD:

sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Important: Always test your SSH configuration in a separate terminal session before closing your current connection. This prevents accidental lockouts. Also, ideally, don't close your connection before Step 2.

Step 2: Firewall Configuration

Linux's UFW provides straightforward firewall management. The approach is to deny all incoming connections by default, then explicitly allow only necessary services.

# Set restrictive defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow essential services
sudo ufw allow 2222/tcp   # SSH on custom port
sudo ufw allow 80/tcp     # HTTP
sudo ufw allow 443/tcp    # HTTPS

# Enable firewall
sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Critical note: It's recommended to perform Steps 1 & 2 during one SSH session to avoid locking yourself out of access.

Step 3: Automated Intrusion Prevention with Fail2Ban

Fail2Ban monitors log files and automatically bans IP addresses showing suspicious behavior, such as repeated failed login attempts.

sudo apt install fail2ban
Enter fullscreen mode Exit fullscreen mode

Modern Ubuntu systems use systemd journaling instead of traditional log files, which requires specific configuration:

sudo nano /etc/fail2ban/jail.local
Enter fullscreen mode Exit fullscreen mode 
[DEFAULT]
bantime = 3600      # Ban duration in seconds
findtime = 600      # Time window for counting failures
maxretry = 3        # Maximum attempts before ban

[sshd]
enabled = true
port = ssh
filter = sshd
backend = systemd   # Use systemd journal
journalmatch = _SYSTEMD_UNIT=ssh.service
Enter fullscreen mode Exit fullscreen mode

After that, restart the service for it to use the updated configuration:

sudo systemctl restart fail2ban
Enter fullscreen mode Exit fullscreen mode

Step 4: Docker Security Configuration

I am a big fan of Docker. I decided to go full docker. It will bring little few more steps but we'll get better security as all services accessible from internet will run in an isolated docker containers.

It also keeps our host machine clean of unecessary installed packages.

Installation is pretty simple and a lot of VPS providers offers fresh install with docker pre-istalled.

When docker is installed create /etc/docker/daemon.json with following content:

{
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}
Enter fullscreen mode Exit fullscreen mode

The no-new-privileges setting is particularly important as it prevents containers from escalating their privileges during runtime, blocking a common attack vector.

As before, don't forget to restart the service:

sudo systemctl restart docker
Enter fullscreen mode Exit fullscreen mode

Current Security Status

The VPS now has:

  • SSH access secured with custom port and key-only authentication
  • Firewall blocking unauthorized connections
  • Automated intrusion detection and response
  • Hardened Docker daemon configuration

This setup effectively blocks automated attacks and provides a solid security foundation for hosting web applications.

Coming Up in Part 2

The next article will cover:

  • Setting up a reverse proxy with Nginx in Docker
  • SSL certificate management with Let's Encrypt
  • Container security best practices
  • System monitoring and maintenance

These foundational security measures provide essential protection while maintaining accessibility for legitimate use.

Top comments (1)

Collapse
 
leob profile image
leob •

"Since applications run in Docker containers" - well, that's a big and unproven assumption :-) ... but for the rest, yeah nice, some useful tips/guidelines :)