How to secure a new Linux VPS: first steps

Before you start

A freshly created VPS is a computer connected to the internet with everything open. Within minutes, automated scans start looking for weak passwords and unpatched services. This guide covers the minimum worth doing on day one on Ubuntu 24.04 or Debian 12, before you install your site or app.

You need the server IP and the root access from your welcome email. The examples use 203.0.113.10 and the user admin; replace them with yours. Log in for the first time with ssh root@203.0.113.10.

Step 1: update the system

The image your VPS was built from may be weeks or months old. The first thing to do is install every pending security update:

apt update
apt full-upgrade -y
ls /var/run/reboot-required && reboot

The last line reboots only if an update, such as a new kernel, requires it. Wait a minute and connect again.

Step 2: create a sudo user

Working as root all the time is risky: any mistake or wrong command runs with full permissions. Create a regular user that can request privileges with sudo when needed:

1. Create the user with adduser admin and give it a strong password (you'll need it for sudo).
2. Add it to the administrators group with usermod -aG sudo admin.
3. If you already log in as root with a key, copy it to the new user with this command.

rsync --archive --chown=admin:admin ~/.ssh /home/admin

Step 3: SSH keys and no more root

If you still log in with a password, set up your keys first. We explain it step by step, for Windows, macOS and Linux, in how to set up SSH keys on a VPS. Once you can log in as admin with your key, create this file to disable passwords and direct root logins:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no

1. Validate the configuration with sudo sshd -t.
2. Restart the service with sudo systemctl restart ssh.
3. Without closing your current session, open another terminal and log in with ssh admin@203.0.113.10. If it works, you can close the first one.

Step 4: turn on the UFW firewall

UFW is the simple way to manage the firewall on Ubuntu and Debian. The idea is to block all incoming traffic and open only what you use. Ubuntu ships with it; on Debian 12 install it with sudo apt install ufw.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

One important detail: if you use Docker, ports published with -p bypass UFW rules. In that case, publish internal services only on 127.0.0.1 and let a proxy such as Nginx handle public traffic.

Step 5: install fail2ban

Even when you no longer accept passwords, bots keep filling your logs. fail2ban reads failed attempts and temporarily bans IPs that keep trying. Install it with sudo apt install fail2ban and put your configuration in a separate file so updates don't overwrite it:

[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
backend = systemd

The backend = systemd line is required on Debian 12, which doesn't keep /var/log/auth.log by default. Apply the changes with sudo systemctl restart fail2ban and list banned IPs with sudo fail2ban-client status sshd.

Step 6: automatic security patches

New vulnerabilities show up all the time. With unattended-upgrades, the server installs security updates on its own every day:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
sudo unattended-upgrade --dry-run --debug

The second command enables it and the third simulates a run to confirm everything works. Kernel patches need a reboot; you can schedule it in /etc/apt/apt.conf.d/50unattended-upgrades with the Unattended-Upgrade::Automatic-Reboot option or reboot yourself at a quiet time.

Optional: change the SSH port

Moving SSH from port 22 to another one, such as 2222, cuts down bot noise in the logs, but it isn't real security: a scan finds the new port in seconds. If you decide to do it, follow this order so you don't lock yourself out:

1. Open the new port with sudo ufw allow 2222/tcp (and in your provider's panel firewall, if you use one).
2. Add Port 2222 to your file in /etc/ssh/sshd_config.d/.
3. On Ubuntu 24.04, SSH starts through a socket: apply it with sudo systemctl daemon-reload and sudo systemctl restart ssh.socket. On Debian 12, with sudo systemctl restart ssh.
4. Test with ssh -p 2222 admin@203.0.113.10 from another terminal and, if it works, close 22 with sudo ufw delete allow OpenSSH.
5. Add port = 2222 to the [sshd] section of fail2ban.

Step 7: backups and snapshots

No security measure replaces a good backup. Combine two layers: a full snapshot of the VPS before big changes, which lets you roll back in minutes, and data backups (databases, site files, configuration) stored off the server. A backup that lives on the same machine is lost along with it. More details in website backups.

Final checklist

Go through this list when you finish and every time you build a new server:

Common errors

• I locked myself out. It's almost always the firewall or a bad SSH setting. Use your provider's web console to get in, fix the UFW rule or the file in sshd_config.d and restart the service.
• sudo says the user is not in the sudoers file. You skipped usermod -aG sudo admin, or didn't log out afterwards. Groups apply when you log in again.
• fail2ban won't start. Check the error with sudo journalctl -u fail2ban -n 30; on Debian it's usually a missing backend = systemd.
• My site doesn't load after enabling UFW. Confirm ports 80 and 443 are open with sudo ufw status.

With the server protected, the next step is putting your project online: follow our guide to deploy a Node app on a VPS with Nginx.