> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crazynode.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Best Practices

> Harden your CrazyNode VPS against attacks with SSH, firewall, and system-level defenses.

A fresh VPS is exposed to constant scanning and brute-force attempts. Apply these hardening steps as soon as you provision a new server.

## The essential checklist

<Steps>
  <Step title="Update the system">
    ```bash theme={null}
    apt update && apt upgrade -y
    ```
  </Step>

  <Step title="Create a non-root user">
    ```bash theme={null}
    adduser deploy && usermod -aG sudo deploy
    ```
  </Step>

  <Step title="Set up SSH keys">
    Follow the [SSH guide](/vps-cloud/ssh) to install your public key.
  </Step>

  <Step title="Disable password login">
    Edit `/etc/ssh/sshd_config`:

    ```text theme={null}
    PasswordAuthentication no
    PermitRootLogin prohibit-password
    ```
  </Step>

  <Step title="Configure a firewall">
    See the [firewall setup guide](/vps-cloud/firewall).
  </Step>

  <Step title="Install fail2ban">
    ```bash theme={null}
    apt install fail2ban -y && systemctl enable --now fail2ban
    ```
  </Step>

  <Step title="Enable automatic security updates">
    ```bash theme={null}
    apt install unattended-upgrades -y
    dpkg-reconfigure --priority=low unattended-upgrades
    ```
  </Step>
</Steps>

## Change the default SSH port (optional)

Moving SSH off port 22 dramatically reduces log noise from bots.

1. Edit `/etc/ssh/sshd_config`: `Port 2222` (or any port between 1024–65535).
2. Open the new port in your firewall **before** restarting SSH.
3. Restart SSH: `systemctl restart sshd`.
4. Log in with `ssh -p 2222 deploy@YOUR_IP`.

## Regular maintenance

* Review `auth.log` for failed login attempts.
* Keep packages updated weekly.
* Rotate SSH keys periodically.
* Take [snapshots](/vps-cloud/managing-vps) before major changes.

## What NOT to do

* Don't leave the root account with a weak password.
* Don't run untrusted scripts as root.
* Don't expose databases (MySQL, Redis, MongoDB) to `0.0.0.0` — bind them to `127.0.0.1`.
* Don't disable the firewall “just to test” and forget to re-enable it.