Skip to main content
A fresh VPS is exposed to constant scanning and brute-force attempts. Apply these hardening steps as soon as you provision a new server.

​
The essential checklist

1

Update the system

2

Create a non-root user

3

Set up SSH keys

Follow the SSH guide to install your public key.
4

Disable password login

Edit /etc/ssh/sshd_config:
5

Configure a firewall

See the firewall setup guide.
6

Install fail2ban

7

Enable automatic security updates

​
Change the default SSH port (optional)

Moving SSH off port 22 dramatically reduces log noise from bots.
  1. Edit /etc/ssh/sshd_config: Port 2222 (or any port between 1024–65535).
  2. Open the new port in your firewall before restarting SSH.
  3. Restart SSH: systemctl restart sshd.
  4. Log in with ssh -p 2222 deploy@YOUR_IP.

​
Regular maintenance

  • Review auth.log for failed login attempts.
  • Keep packages updated weekly.
  • Rotate SSH keys periodically.
  • Take snapshots before major changes.

​
What NOT to do

  • Don’t leave the root account with a weak password.
  • Don’t run untrusted scripts as root.
  • Don’t expose databases (MySQL, Redis, MongoDB) to 0.0.0.0 — bind them to 127.0.0.1.
  • Don’t disable the firewall “just to test” and forget to re-enable it.