VPS Security: The First 10 Settings
For a new virtual server, we cover SSH, firewall, fail2ban and update settings in the right order, with working commands and common mistakes.
Aurora YazılımEditorial team
6 min read
For VPS security, the first job is to update the system, create a sudo-enabled user instead of using root, and set up SSH key login. Then disable root and password SSH login, open only the necessary ports in the firewall, install fail2ban, enable automatic security updates and schedule regular backups.
Where Does VPS Security Start?
A newly created virtual server is a target for automated scanners from the moment it connects to the internet. These bots do not aim at a particular company; they try every machine where they find an open SSH port and a weak password. It is normal to see thousands of login attempts in server logs within the first hours.
That is why VPS security starts with a few basic settings made in the first hour after setup. The ten steps below are written for Ubuntu and Debian based servers; on other distributions the package manager and service names differ, but the logic is the same.
If server administration is new to you, or if your site is run by a software team, clarify up front who is responsible for these steps. Security settings are not something you do once and forget; they are a process that needs regular maintenance.
What You Need to Know Before You Begin
Before starting, you should have the following: the server's IP address, the initial root or admin access given by your provider, and a terminal on your own computer. On Windows 10 and 11 the OpenSSH client is built into PowerShell; on macOS and Linux, Terminal is enough.
Saving your commands in a notes file as you go is also a good habit. Knowing which setting you changed and when makes it easier to find the cause if a problem comes up later, and lets you repeat the same setup on a second server. If you get stuck during setup, you can ask our team through the contact page.
System and User Settings
The first two steps are clearing known vulnerabilities from the server and doing day-to-day work with an account other than root.
1. Update the system
Your provider's ready-made image may have been built months ago. The first job is to refresh all packages with current security patches. If a kernel update arrived, restart the server.
sudo apt update && sudo apt upgrade -y
sudo reboot2. Create a sudo-enabled user
Working as root means a single wrong command can affect the whole system. Create a user of your own and add it to the sudo group; use admin privileges only when needed.
sudo adduser yonetici
sudo usermod -aG sudo yoneticiSSH Security
SSH is the front door of the server. The two most effective steps for SSH security are using keys instead of passwords and disabling root login.
3. Set up SSH key login
Generate a key pair on your own computer and copy the public key to the server. On macOS and Linux the ssh-copy-id command does this in one step; on Windows you can transfer the public key to the server with PowerShell. Giving the key a passphrase adds protection even if your computer is compromised.
ssh-keygen -t ed25519
ssh-copy-id yonetici@SUNUCU_IPssh-keygen -t ed25519
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh yonetici@SUNUCU_IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"4. Disable root and password login
After confirming in a second terminal that key login works, harden the SSH configuration. Testing the configuration before the change prevents a faulty line from stopping the service.
Note: on some cloud images, extra files in the /etc/ssh/sshd_config.d/ folder can re-enable password login. After making the change, check this folder as well.
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yessudo sshd -t
sudo systemctl restart sshFirewall and Fail2ban
Only the ports that actually serve the outside should be open on the server. Correct firewall settings shrink the attack surface; fail2ban automatically blocks addresses that keep trying.
5. Enable the firewall
On Ubuntu, UFW offers a simple interface on top of iptables. Allow SSH first, then enable the firewall; if you do it in the wrong order, your connection drops.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose6. Install Fail2ban
Fail2ban watches the logs and blocks IP addresses with repeated failed logins for a set time. Make settings not in the main file but in jail.local, which is not overwritten by updates.
sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban[sshd]
enabled = true
maxretry = 5
bantime = 1h
findtime = 10msudo systemctl restart fail2ban
sudo fail2ban-client status sshdUpdates and Services
A significant share of security breaches come from software whose patch was released long ago but never applied. Every unnecessary running service is a separate risk too.
7. Automatic security updates
The unattended-upgrades package applies security patches without your intervention. Do major version upgrades manually in a controlled way, after taking a backup.
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades8. Audit open ports and services
List which service listens on which port. Services that should only be reached from inside the server, such as databases, should listen on 127.0.0.1 and not be open to the outside world. Shut down services you do not use.
sudo ss -tulpn
sudo systemctl disable --now SERVIS_ADIMonitoring and Backups
If you publish a website on the server, HTTPS should be added to these steps; we covered installing the free certificate and its automatic renewal in our SSL certificate setup article.
9. Monitor logs and resources
Logs are the easiest way to notice an attack. Regularly check SSH logins, disk usage and unusual CPU use. The server clock also has to be correct for the logs to make sense.
sudo journalctl -u ssh --since today
df -h
timedatectl10. Plan backups and snapshots
No security measure is one hundred percent; the last line of defense is an off-server backup. Use your provider's snapshot feature, but do not rely on it alone: also send database and file backups to separate storage, and test restores regularly. For strategy, see our how to back up guide.
If You Use Docker
Ports published by Docker edit the iptables rules directly, so they can bypass UFW rules. In other words, a database port that looks closed in UFW can be reachable from outside if it was published with docker run -p.
The fix is to bind container ports that should only be reached from inside the server to 127.0.0.1 and to open only ports 80 and 443 to the outside, through a reverse proxy. For details, see Docker's official networking documentation.
docker run -d -p 127.0.0.1:5432:5432 postgresCommon Mistakes and Next Steps
These ten steps are a starting point. The application running on the server must also be kept up to date, admin panels should be protected with two-step verification, and a quick response plan should be ready for suspicious activity. We walked through what to do after an attack step by step in our hacked website article.
If you do not want to run server administration with your own team, our speed and performance management service, which handles the hosting, security and speed layers of a site together, takes that load off you. In our e-commerce platform, web design and industry software solutions projects, server security is planned as part of the launch process.
| Mistake | Consequence | The right approach |
|---|---|---|
| Enabling UFW without allowing SSH | Server access is cut off | First run ufw allow OpenSSH |
| Disabling password login without testing the key | You lock yourself out | Test in a second terminal |
| Leaving the database open to the outside | Data directly exposed to attack | Bind it to 127.0.0.1 |
| Keeping the backup on the same server | The backup is lost along with the server | Use separate storage |
| Postponing updates for months | Known vulnerabilities stay open | Automatic security updates |
Frequently Asked Questions
01Does changing the SSH port improve security?
Changing the default port 22 reduces automated bot traffic and log noise, but it is not a real security measure. The real protection comes from measures such as key login, disabled password login and fail2ban. If you change the port, do not forget to allow the new port in the firewall.
02Managed server or should I manage it myself?
If you are comfortable with Linux administration and can set aside time for regular maintenance, you can manage the VPS yourself. If not, a managed service or an experienced team keeps updates and monitoring from slipping; neglected maintenance is the most common cause of security holes.
03What should I do if Fail2ban blocks me?
Log in to the server from your provider's web console and remove the block with sudo fail2ban-client set sshd unbanip IP_ADRESI. If you have a static IP address, you can prevent a repeat by adding it to the ignoreip line in jail.local.
On a new VPS, these ten settings defeat the vast majority of automated attacks from day one; together with regular updates and a tested backup, they form a solid foundation. If you want to manage your server's security and speed together, with measurement, you can look at Aurora's speed and performance management service.
