Why Security Is Essential

There are networks of malicious machines (bots) whose only purpose is to scan and attack vulnerable servers. Common attack methods include:

• Port scans: searching for exposed services (SSH, HTTP, FTP…).
• Root login attempts: targeting the SSH service on port 22 by default.
• Brute force / dictionary attacks: automatically testing billions of password combinations.

Without protection, your VPS could be compromised within hours—or even minutes—after going online.

Level 1 – Keep the System Updated

An outdated system is an easy target, as known vulnerabilities are public knowledge.
Vendors release frequent security patches, and you must apply them quickly.

Essential commands:

apt update && apt upgrade -y

Repeat regularly. To automate, install:

apt install unattended-upgrades

This ensures critical security updates are installed automatically.

Level 2 – Use a Strong Password (or Better: SSH Keys)

A weak or predictable password can be cracked in seconds using brute force.

Password Best Practices

• Minimum length: 12–16 characters.
• Complexity: mix uppercase, lowercase, numbers, and special characters.
• Avoid: names, birthdays, dictionary words.
• Never reuse the same password across different services.

Example of a strong password:

py$XoTTUdBYY@!9f

To change the root password:

passwd root

Professional Recommendation

Where possible, avoid password authentication altogether and use SSH keys:

ssh-keygen -t ed25519

Add your public key to:
~/.ssh/authorized_keys

Then disable password authentication in /etc/ssh/sshd_config:

PasswordAuthentication no

Level 3 – Change the SSH Port

Changing the default SSH port (22) makes automated scans more difficult.

Edit the file:

nano /etc/ssh/sshd_config

Replace:

#Port 22

with a port of your choice (e.g., 22022).

Restart the service:

systemctl restart ssh

⚠️ Before closing your session, open a second connection to test the new port.

Level 4 – Install Fail2Ban

Fail2Ban monitors your logs and blocks IP addresses after repeated failed login attempts.

Install:

apt install fail2ban -y

Create a custom configuration:

cd /etc/fail2ban/jail.d/
nano custom.conf

Example configuration:

[DEFAULT]
ignoreip = 127.0.0.1
findtime = 3600
bantime  = 86400
maxretry = 3

[sshd]
enabled = true
port = 22022   # your SSH port
logpath = /var/log/auth.log

Restart:

systemctl restart fail2ban

Level 5 – Enable a Firewall

Your VPS should only expose the services you actually need. Everything else must be blocked.

With UFW (simple)

apt install ufw -y
ufw default deny incoming
ufw default allow outgoing
ufw allow 22022/tcp   # SSH
ufw allow 80,443/tcp  # HTTP/HTTPS
ufw enable

With iptables/nftables (advanced)

Useful for more complex setups (DoS mitigation, IP filtering, etc.).

Level 6 – Create a Non-Root User

The root account should never be used directly. Create a standard user with sudo rights:

adduser myuser
usermod -aG sudo myuser

Then disable root SSH login:

PermitRootLogin no

Level 7 – Backups and Monitoring

A well-secured server is not only protected against intrusions but also ready for quick recovery.

• Regular backups: databases, configs, and critical files.
• Monitoring: track CPU, RAM, disk usage, and logs (via Prometheus, Grafana, or external services).
• Intrusion detection: tools like rkhunter, chkrootkit, or Lynis.

Conclusion

Securing your VPS is not optional—it’s a requirement.
An unprotected VPS will inevitably be compromised.

Minimal checklist:

1. Keep your system updated.
2. Use strong passwords (preferably SSH keys).
3. Change the SSH port and disable root login.
4. Install Fail2Ban.
5. Enable a firewall.
6. Use a non-root user.
7. Plan backups and monitor your system.

By following these steps, you greatly increase your VPS’s resilience against attacks.