A new VPS is attacked within minutes of getting an IP address — automated scanners try root with common passwords around the clock. None of that succeeds against a server that has had the following ten steps done. Budget an hour. Commands are given for Ubuntu/Debian and, where different, for AlmaLinux/Rocky.
1. Update everything
# Ubuntu / Debian
apt update && apt full-upgrade -y && reboot
# AlmaLinux / Rocky
dnf upgrade -y && rebootThe image the VPS was created from is usually weeks old. Patch before anything else.
2. Create a sudo user and stop using root
adduser deploy
usermod -aG sudo deploy # Ubuntu / Debian
usermod -aG wheel deploy # AlmaLinux / RockyLog in as deploy from now on and use sudo for administration. The full walkthrough is in create a sudo user and disable root login.
3. Use SSH keys, then turn passwords off
On your own machine:
ssh-keygen -t ed25519 -C "you@example.com"
ssh-copy-id deploy@203.0.113.10Confirm the key login works in a second terminal before continuing. Then on the server, in /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yessudo systemctl restart ssh # sshd on AlmaLinuxPassword guessing is now impossible, whatever the attacker tries.
4. Put a firewall in front
Allow only what the server serves. For a web server that is SSH, HTTP and HTTPS:
# Ubuntu / Debian
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable# AlmaLinux / Rocky
sudo firewall-cmd --permanent --add-service={ssh,http,https}
sudo firewall-cmd --reloadA database, Redis or a mail server that only the local application uses should not be opened. Check what is listening:
sudo ss -tulpnAnything bound to 0.0.0.0 that you did not intend to expose should be bound to 127.0.0.1 in its config.
5. Install Fail2ban
Even with keys only, the login attempts fill your logs and consume CPU. Fail2ban bans an IP after a few failures:
sudo apt install fail2ban -y # dnf install fail2ban -y
sudo systemctl enable --now fail2banThe default jail covers SSH. Adding jails for Nginx, Plesk and WordPress is covered in Fail2ban: stop brute-force attacks.
6. Turn on automatic security updates
# Ubuntu / Debian
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades
# AlmaLinux / Rocky
sudo dnf install dnf-automatic -y
sudo systemctl enable --now dnf-automatic-install.timerThis applies security patches nightly without touching anything else. Kernel updates still need a reboot; check with needrestart or dnf needs-restarting -r.
7. Sync the clock
Logs, TLS certificates and two-factor codes all depend on the time being right:
sudo timedatectl set-timezone Europe/London
sudo timedatectl set-ntp true
timedatectl8. Remove what you do not use
Every service is attack surface. A fresh image often has an FTP daemon, a mail server or a print service running:
systemctl list-units --type=service --state=runningDisable what the server does not need: sudo systemctl disable --now vsftpd and so on.
9. Set up backups before you need them
A hardened server can still fail, be deleted by mistake, or get hit by a zero-day. Take backups off the machine — to object storage or another server — and test a restore once. Our guide: back up a server with rsync and restic.
10. Know what normal looks like
Spend five minutes now so you notice change later:
last -n 20 # recent logins
sudo journalctl -p err -b # errors since boot
df -h && free -m # disk and memoryWrite the numbers down. Next month, compare.
What we do beyond this
On a VPSPioneer managed VPS all ten steps are done before handover, plus kernel live-patching, malware scanning, daily backups with a 14-day offsite copy, and monitoring that pages an engineer at 3 a.m. so you do not have to. If you would rather run the checklist yourself, it takes an hour and this page is all you need.