How to Secure a New Linux VPS in 15 Minutes

Before you start

You need the server's IPv4 address and root password or SSH key from the customer portal, and a terminal: Terminal on macOS and Linux, or Windows Terminal with the built-in OpenSSH client on Windows 10 and 11. If you lock yourself out at any point, the browser-based VNC console in the control panel still gives you a login prompt, so none of these steps is irreversible.

1. Log in and update everything

ssh [email protected]

Replace the address with your own. Then bring the system fully up to date. On Ubuntu and Debian:

apt update && apt full-upgrade -y

On AlmaLinux, Rocky Linux and Fedora:

dnf upgrade -y

If a new kernel was installed, reboot now with reboot and log back in.

2. Create a non-root user with sudo

Working as root all the time means one mistyped command can do unlimited damage. Create your own account instead:

adduser deploy                 # Debian / Ubuntu
usermod -aG sudo deploy

adduser deploy && passwd deploy   # AlmaLinux / Rocky
usermod -aG wheel deploy

3. Install your SSH key for that user

From your own computer, not the server, copy your public key across. If you do not have a key yet, follow our SSH key guide first.

ssh-copy-id [email protected]

Open a new terminal and confirm ssh [email protected] works and that sudo whoami prints root. Keep the original root session open until you have checked.

4. Lock down the SSH daemon

Create a drop-in file so package upgrades never overwrite your settings:

sudo tee /etc/ssh/sshd_config.d/10-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
EOF
sudo sshd -t && sudo systemctl reload ssh || sudo systemctl reload sshd

sshd -t checks the configuration before reloading. The service is called ssh on Ubuntu and Debian and sshd on RHEL-family systems, which is why both are tried.

5. Turn on a firewall

Allow SSH first, then enable the firewall, then add the services you actually run. On Ubuntu and Debian with UFW:

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw enable

On AlmaLinux and Rocky Linux, firewalld is already installed. Our dedicated UFW and firewalld guides cover web, database and custom ports. You can also set inbound rules in the VeloxMedia control panel, which apply before traffic reaches the server.

6. Block repeated login failures

Key-only SSH already defeats password guessing, but fail2ban keeps the noise out of your logs and protects other services too.

sudo apt install -y fail2ban          # Debian / Ubuntu
sudo dnf install -y epel-release && sudo dnf install -y fail2ban   # RHEL family
sudo systemctl enable --now fail2ban

The default jail protects SSH. Check it with sudo fail2ban-client status sshd.

7. Automate security updates

Most compromises use vulnerabilities that already have patches. Our automatic security updates guide sets up unattended-upgrades or dnf-automatic in a few commands.

8. Set the basics

sudo timedatectl set-timezone Europe/London
sudo hostnamectl set-hostname web1

Set reverse DNS for your IPv4 in the control panel if the server will send email, and take a snapshot now. You have a clean, hardened baseline you can roll back to at any time.

A quick checklist

• System fully updated and rebooted
• Personal sudo user, root SSH login disabled
• Key-only authentication
• Firewall enabled with only required ports open
• fail2ban running
• Automatic security updates on
• Snapshot taken of the clean state