How to secure VPS server in production

This guide covers basic but essential production-level VPS security for Ubuntu/Debian servers. Follow the steps in order to avoid accidental lockout.

Update system packages

Always update package lists before installing anything.

shellCopy
apt update

Enable automatic security updates

Automatically installs critical security patches.

shellCopy
apt install unattended-upgrades

shellCopy
dpkg-reconfigure --priority=low unattended-upgrades

Create a non-root user

Never use the root user for daily operations.

shellCopy
adduser <username>

Grant sudo access.

shellCopy
usermod -aG sudo <username>

Logout from root.

shellCopy
logout

Login using the new user.

shellCopy
ssh <username>@ip

Authentication key pair (SSH keys)

SSH keys are more secure than passwords.

Create SSH directory on server.

shellCopy
mkdir ~/.ssh && chmod 700 ~/.ssh

Generate SSH key on your local machine.

shellCopy
ssh-keygen -t ed25519 -C "your_email@example.com"

Add a passphrase if you want extra protection.

Go to .ssh directory on your local machine.

shellCopy
cd .ssh

Copy public key to server (Windows).

powershellCopy
scp $env:USERPROFILE/.ssh/id_rsa.pub <username>@ip:~/.ssh/authorized_keys

Copy public key to server (Linux / macOS).

bashCopy
scp ~/.ssh/id_rsa.pub <username>@ip:~/.ssh/authorized_keys

SSH hardening (server-side)

Edit /etc/ssh/sshd_config and apply the following changes:

1. Change SSH port (example: 717)
2. Force IPv4
3. Disable root login
4. Disable password authentication

textCopy
Port 717
AddressFamily inet
PermitRootLogin no
PasswordAuthentication no

Restart SSH service.

shellCopy
sudo systemctl restart sshd

Login using the new port.

shellCopy
ssh username@ip -p <portnumber>

Firewall (UFW)

Check open ports.

shellCopy
sudo ss -tupln

Install UFW.

shellCopy
sudo apt install ufw

Check firewall status.

shellCopy
sudo ufw status

Allow custom SSH port.

shellCopy
sudo ufw allow 717

Enable firewall.

shellCopy
sudo ufw enable

Edit UFW rules for ICMP.

shellCopy
sudo nano /etc/ufw/before.rules

Block ping requests (optional).

textCopy
-A ufw-before-input -p icmp --icmp-type echo-request -j DROP

Reboot server.

shellCopy
sudo reboot

Configure Fail2Ban

Protects against brute-force SSH attacks.

shellCopy
sudo apt install fail2ban -y

Create local config.

shellCopy
sudo nano /etc/fail2ban/jail.local

Basic SSH jail configuration.

textCopy
[sshd]
enabled = true
port = <your-port>
maxretry = 3
bantime = 15m

Restart Fail2Ban.

shellCopy
sudo systemctl restart fail2ban

Check status.

shellCopy
sudo systemctl status fail2ban

View active jails.

shellCopy
sudo fail2ban-client status

Optional: Google Authenticator (2FA)

Adds two-factor authentication for SSH.

shellCopy
sudo apt install libpam-google-authenticator
google-authenticator

Disable password authentication for a specific user.

textCopy
Match User divya
	  PasswordAuthentication no