VPS Security Hardening Checklist

Securing your VPS is essential to protect your data and applications. This comprehensive checklist covers all critical security measures you should implement on your {{COMPANY_NAME}} VPS immediately after provisioning.

1. System Updates

Keep your operating system and all packages up to date.

Ubuntu/Debian

sudo apt update && sudo apt upgrade -y

CentOS/RHEL

sudo yum update -y
# or on newer versions
sudo dnf update -y

Tip: Enable automatic security updates to stay protected:

```bash

sudo apt install unattended-upgrades

sudo dpkg-reconfigure unattended-upgrades

```

2. Create a Non-Root User

Avoid using the root account for daily operations.

# Create a new user
adduser myuser

# Grant sudo privileges
usermod -aG sudo myuser

# Switch to new user
su - myuser

Test that the new user can run sudo commands before proceeding.

3. Secure SSH Access

3a. Use SSH Key Authentication

# On your local machine, generate a key
ssh-keygen -t ed25519

# Copy to server
ssh-copy-id myuser@YOUR_VPS_IP

3b. Disable Root Login and Password Authentication

Edit SSH configuration:

sudo nano /etc/ssh/sshd_config

Set the following values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
UsePAM no
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

Restart SSH:

sudo systemctl restart sshd

Tip: Keep your current SSH session open while testing the new configuration in a separate terminal. This prevents lockouts.

3c. Change the Default SSH Port

Edit /etc/ssh/sshd_config:

Port 2222

Update your firewall rules before restarting SSH:

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp
sudo systemctl restart sshd

4. Configure a Firewall

# Set defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow your SSH port
sudo ufw allow 2222/tcp

# Allow web traffic (if running a web server)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable

5. Install and Configure Fail2ban

Fail2ban automatically blocks IPs that show malicious signs.

sudo apt install fail2ban -y

Create a local configuration:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Key settings:

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

Restart fail2ban:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

# Check status
sudo fail2ban-client status sshd

6. Disable Unused Services

List running services and disable what you do not need:

# List all running services
systemctl list-units --type=service --state=running

# Disable unnecessary services
sudo systemctl stop SERVICE_NAME
sudo systemctl disable SERVICE_NAME

Common services to review: cups, avahi-daemon, bluetooth, rpcbind.

7. Set Up Intrusion Detection

Install and configure rkhunter to check for rootkits:

sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --check

Set up a daily scan via cron:

sudo crontab -e
# Add:
0 3 * * * /usr/bin/rkhunter --check --skip-keypress --report-warnings-only | mail -s "rkhunter report" [email protected]

8. Secure Shared Memory

Prevent shared memory exploits:

sudo nano /etc/fstab

Add:

tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

9. Configure Log Monitoring

Important log files to monitor:

• /var/log/auth.log -- authentication attempts
• /var/log/syslog -- system events
• /var/log/fail2ban.log -- blocked IPs
• /var/log/ufw.log -- firewall activity

Install logwatch for daily summaries:

sudo apt install logwatch -y
sudo logwatch --detail High --mailto [email protected] --range today

10. Set Up Automatic Backups

Schedule regular backups of critical data:

# Simple backup script
sudo nano /usr/local/bin/backup.sh

#!/bin/bash
DATE=$(date +%Y%m%d)
tar -czf /backup/server-backup-$DATE.tar.gz /etc /var/www /home
find /backup -mtime +30 -delete

sudo chmod +x /usr/local/bin/backup.sh
sudo crontab -e
# Add:
0 2 * * * /usr/local/bin/backup.sh

Quick Reference Checklist

• System fully updated
• Non-root user created with sudo access
• SSH key authentication enabled
• Root login disabled
• Password authentication disabled
• SSH port changed from default
• Firewall configured and enabled
• Fail2ban installed and configured
• Unused services disabled
• Intrusion detection installed
• Shared memory secured
• Log monitoring configured
• Automated backups scheduled

Related Articles

• Setting Up a Firewall on Your VPS (UFW/iptables)
• How to Connect to Your VPS via SSH
• Monitoring VPS Resources (CPU, RAM, Disk)

Need help hardening your VPS? Contact our support team at {{SUPPORT_EMAIL}} or open a ticket at {{SUPPORT_URL}}.