How to Secure Your Linux VPS in 10 Steps

The very first thing you should do on a new VPS is update all installed packages. Operating system vendors constantly patch security vulnerabilities, and a fresh server image from your provider may already be weeks or months out of date.

$ apt update && apt upgrade -y
$ apt autoremove -y   # Remove unused packages

$ dnf update -y

After upgrading, reboot if a kernel update was installed: reboot

Logging in as root is dangerous — any mistake runs with full system privileges. Create a regular user and grant it sudo access for administrative tasks.

$ adduser youruser
$ usermod -aG sudo youruser   # Ubuntu/Debian
$ usermod -aG wheel youruser  # CentOS/RHEL

Switch to the new user and verify sudo access:

$ su - youruser
$ sudo whoami   # Should output: root

SSH key pairs are vastly more secure than passwords. A cryptographic key pair is virtually impossible to brute-force, while even a strong password can eventually be cracked.

On your local machine, generate a key pair if you don’t already have one:

$ ssh-keygen -t ed25519 -C "your@email.com"

Then copy the public key to your VPS:

$ ssh-copy-id youruser@your-server-ip

# Or manually:
$ cat ~/.ssh/id_ed25519.pub | ssh youruser@your-server-ip \
  "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Once your SSH key is working, disable password-based login entirely. This eliminates brute-force attacks targeting SSH overnight.

$ nano /etc/ssh/sshd_config

Find and set these three lines:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH to apply changes:

$ systemctl restart sshd

SSH runs on port 22 by default, and automated scanners hit this port millions of times per day. Changing it to a non-standard port (e.g., 2222 or any port above 1024) reduces noise significantly.

Port 2222   # Choose any unused port between 1024–65535

$ ssh -p 2222 youruser@your-server-ip

Remember to allow the new port through your firewall (covered in Step 6) before restarting sshd.

UFW (Uncomplicated Firewall) is the simplest way to manage firewall rules on Ubuntu/Debian. The goal: deny everything by default, then explicitly allow only what you need.

$ apt install ufw -y

# Set default policies
$ ufw default deny incoming
$ ufw default allow outgoing

# Allow your custom SSH port
$ ufw allow 2222/tcp

# Allow web traffic (if running a web server)
$ ufw allow 80/tcp
$ ufw allow 443/tcp

# Enable the firewall
$ ufw enable
$ ufw status verbose

Fail2Ban monitors log files and automatically bans IP addresses that show signs of malicious activity — like repeatedly failing SSH login attempts. It’s one of the most effective and lightweight security tools available.

$ apt install fail2ban -y

# Create a local config override
$ cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
$ nano /etc/fail2ban/jail.local

In jail.local, update the SSH section:

[sshd]
enabled  = true
port     = 2222       # Your custom SSH port
maxretry = 5         # Ban after 5 failed attempts
bantime  = 3600      # Ban for 1 hour (seconds)
findtime = 600       # Within a 10-minute window

$ systemctl enable fail2ban
$ systemctl start fail2ban
$ fail2ban-client status sshd   # Verify it's running

Manually updating your server is easy to forget. Enable unattended upgrades to automatically apply security patches — without touching feature updates that might break things.

$ apt install unattended-upgrades -y
$ dpkg-reconfigure --priority=low unattended-upgrades

Confirm the configuration at /etc/apt/apt.conf.d/20auto-upgrades contains:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The /run/shm shared memory space can be exploited to run malicious code. Mount it with restrictions to prevent execution.

$ nano /etc/fstab

# Add this line at the bottom:
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

Remount to apply without rebooting:

$ mount -o remount /run/shm

Intrusion detection tools scan your server for known vulnerabilities, rootkits, and misconfigurations. Run them periodically to catch problems before attackers do.

Option A: Lynis (Full Security Audit)

$ apt install lynis -y
$ lynis audit system   # Generates a detailed security report

Lynis outputs a hardening index score and a list of recommended improvements. Work through the suggestions over time.

Option B: rkhunter (Rootkit Scanner)

$ apt install rkhunter -y
$ rkhunter --update
$ rkhunter --check --skip-keypress