Secure a new VPS: the first 15 minutes on Ubuntu and Debian

To secure a new VPS, update the system, create a user with sudo, log in with an SSH key, turn off password and root login, open only the ports you need with ufw, and let fail2ban and unattended-upgrades deal with brute force and security patches. On Ubuntu 24.04 or Debian 12 it takes about 15 minutes, and it is worth doing before you install anything else.

What you need

• Any VPS plan with Ubuntu 24.04 or Debian 12. The checklist is the same on Pulse (2 vCPU, 2 GB, $10/month) and on Titan, and on a dedicated server too.
• The IP address and root password from your account, and a first login as described in connecting over SSH.

Keep that first root session open until the very end. It is your way back if a step goes wrong.

1. Update the system

apt update && apt full-upgrade -y
[ -f /var/run/reboot-required ] && reboot

If the kernel was updated, the server reboots. Log in again as root.

2. Create a user with sudo

apt install -y sudo
adduser deploy
usermod -aG sudo deploy

deploy is just an example name. Debian images may not have sudo installed, hence the first line.

3. Log in with a key

On your own computer (not the server):

ssh-keygen -t ed25519
ssh-copy-id deploy@203.0.113.10
ssh deploy@203.0.113.10
sudo whoami

The last command should print root. Only continue once the key login and sudo work in a new window.

4. Turn off password and root login

cat > /etc/ssh/sshd_config.d/00-hardening.conf <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sshd -t && systemctl restart ssh
sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'

sshd uses the first value it finds, and files in sshd_config.d/ are read in name order. The 00- prefix makes sure your file wins over others such as 50-cloud-init.conf, which may switch password login back on. The last command should show no for both.

5. Firewall with ufw

apt install -y ufw
ufw allow 22/tcp
ufw enable
ufw status verbose

By default ufw blocks incoming traffic and allows outgoing. Open other ports as you need them, for example ufw allow 80,443/tcp for a website. If you run Docker, read about the ufw trap: published container ports bypass these rules.

6. fail2ban against brute force

apt install -y fail2ban python3-systemd
cat > /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h
EOF
systemctl restart fail2ban
fail2ban-client status sshd

backend = systemd matters on Debian 12, which logs to the journal and has no /var/log/auth.log by default. With key-only login, brute force can't succeed anyway, but fail2ban keeps the logs clean and the bots away.

7. Automatic security updates

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
unattended-upgrade --dry-run --debug | tail -n 5

Answer "Yes" in the dialog. Security updates are then installed daily. The server does not reboot by itself: to allow that, set Unattended-Upgrade::Automatic-Reboot "true"; in /etc/apt/apt.conf.d/50unattended-upgrades.

8. Protect the account, too

Whoever gets into your account can reinstall the server or reset the root password from there. Turn on two-factor authentication for the account and keep the recovery codes off your phone.

Common mistakes

• Locked out after step 4. Usually the key was copied for root, not for the new user, or the wrong .pub file was used. Fix it from the root session you kept open.
• ufw enable before ufw allow 22/tcp. The current session survives, new ones don't. Allow SSH from that session.
• Banned yourself. fail2ban-client set sshd unbanip <your IP>.
• No way back in at all. The last resort is a reinstall from the account, which wipes the disk. Backups are your job, so keep copies of your data elsewhere.

Order a VPS