A freshly delivered VPS is functional but not hardened. Here is the recommended order for securing a machine before installing anything sensitive on it.
1. Set up an SSH key
If you have not done so already (see the article on SSH connections), generate and install an SSH key before any other step — it is the foundation everything else rests on.
2. Disable password authentication
Once the SSH key works and has been tested, disable password authentication in the SSH configuration so that only key-based connections are accepted:
sudo nano /etc/ssh/sshd_configChange or add the line:
PasswordAuthentication noThen restart the service:
sudo systemctl restart sshd3. Create a non-root user for everyday work
See the dedicated article on creating a non-root user — avoid using root for day-to-day tasks, and reserve it for the operations that genuinely require it.
4. Enable the firewall
Configure a firewall (see the dedicated UFW article) so that only the ports actually in use are open — SSH, plus the services you intend to expose (web, game, and so on).
5. Enable automatic security updates
On Debian/Ubuntu, the unattended-upgrades package applies security patches automatically without any intervention:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades6. Change the default SSH port (optional)
Changing the default port 22 does not make the server more secure in itself (it is not a real security measure), but it greatly reduces the noise from automated scans in your logs — mostly useful for keeping logs readable.