DEV Community

Cover image for Increase Debian based Linux VPS server’s security
Shakhzhakhan Maxudbek
Shakhzhakhan Maxudbek

Posted on • Originally published at args.tech

Increase Debian based Linux VPS server’s security

#linux #ssh #security #vps

When you bought new virtual private server (VPS) most providers give machines with remotely root access by SSH protocol, and it's not safe. This article provide some tips for help you increase VPS server's security. Let's start setting up.

First of all connect to your new server:

ssh root@your_servers_ip
Enter fullscreen mode Exit fullscreen mode

Note: provider should send SSH credentials for the new VPS server via email.

Create new user with "adduser" command:

adduser user
Enter fullscreen mode Exit fullscreen mode

System open interactive shell and will offer you to set some data:

root@your_servers_id:~# adduser user
Adding user `user' ...
Adding new group `user' (1000) ...
Adding new user `user' (1000) with group `user' ...
Creating home directory `/home/user' ...
Copying files from `/etc/skel' ...
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for user
Enter the new value, or press ENTER for the default
    Full Name []: My User
    Room Number []:
    Work Phone []:
    Home Phone []:
    Other []:
Is the information correct? [Y/n] y
Enter fullscreen mode Exit fullscreen mode

Note: you may leave blank first five lines and just press "Enter". But latest line need confirmation.

Now add new user in sudoers for running commands as root:

usermod -aG sudo user
Enter fullscreen mode Exit fullscreen mode

If your machine haven't "sudo" utility, you need to install it:

apt update && apt install sudo -y
Enter fullscreen mode Exit fullscreen mode

Logout and login with newly created user:

ssh user@your_servers_ip
Enter fullscreen mode Exit fullscreen mode

Now remove root user's password:

sudo passwd -d root
Enter fullscreen mode Exit fullscreen mode

Disable root user's login by SSH. Edit /etc/ssh/sshd_config file, find and set PermitRootLogin value to no:

PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

After making changes restart sshd service:

sudo systemctl restart sshd.service
Enter fullscreen mode Exit fullscreen mode

Disable ipv6. Add in bottom of /etc/sysctl.conf file following lines:

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
Enter fullscreen mode Exit fullscreen mode

Apply changes without restarting system:

sudo sysctl -p
Enter fullscreen mode Exit fullscreen mode

Install UFW utility for manage network access:

sudo apt install ufw -y
Enter fullscreen mode Exit fullscreen mode

Add UFW rules for OpenSSH service to restricting access to your server:

sudo ufw allow from X.X.X.X to any port 22
Enter fullscreen mode Exit fullscreen mode

Where X.X.X.X is your router's external address.

Enable UFW for autorun (when system started):

sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Top comments (0)

Read next

jitanshuraut profile image

Algo-Trading Engine

Jitanshu Raut -

david-arcjet profile image

Next.js server action security

David Mytton -

rajeshkumaryadavdotcom profile image

Unlock Ultimate Security: How to Use YubiKey (or Any Security Key) for Passwordless Access in Azure Virtual Machines!

Rajesh Kumar Yadav -

viradiaharsh profile image

Introducing the AWS CDK L2 Construct: Simplified Security for Amazon CloudFront with Origin Access Control (OAC)

Harsh Viradia -