Securing your VPS: the first 10 steps after delivery

A freshly delivered VPS is scanned within minutes of going online. That isn't paranoia: bots continuously sweep the address space looking for a port 22 with a weak password. Here's the list to run before anything else.

1. Change the root password

The first command, before installing anything:

passwd

A long, unique password from a password manager. Not a variation on the domain name.

2. Create a non-root user

Working as root permanently turns the smallest typo into an incident:

adduser artaun
usermod -aG sudo artaun

On Rocky or AlmaLinux, replace sudo with wheel.

3. Move to SSH keys

This is the change that buys the most security for the least effort. From your own machine:

ssh-keygen -t ed25519 -C "my-laptop"
ssh-copy-id artaun@your-ip

Test the key-based login in a second terminal before closing the first. A mistake here locks you out.

4. Disable password login

In /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Then systemctl restart ssh. From that point, the thousands of daily dictionary attempts have no chance at all.

5. Enable a firewall

The principle is to close everything, then open only what's needed:

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

6. Install fail2ban

It automatically bans addresses that pile up authentication failures:

apt install fail2ban
systemctl enable --now fail2ban

The default configuration already protects SSH, which covers most of the risk.

7. Turn on automatic security updates

apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades

This is the highest-return measure on the whole list: most compromises exploit flaws that were patched months earlier.

8. Limit exposed services

Check what actually listens on the network:

ss -tulpn

A database should listen only on 127.0.0.1. A MySQL open on 0.0.0.0 is an invitation.

9. Set up your own backups

Your host's backups protect the infrastructure, not your application data. Install restic or borg, schedule a daily job to external storage, and — the essential point — test a restore. A backup never restored is only a hypothesis.

10. Monitor

Check disk space, memory and load regularly. A disk at 100% stops a service just as surely as an attack, and it's far more common.

Our Linux VPS documentation covers each step command by command, with the variants for each distribution.