Setup & operation

How do I secure a new VPS?

Short answer

Five steps cover the overwhelming majority of real-world compromises: key-based SSH with password authentication disabled, no direct root login, a default-deny firewall, unattended security updates, and fail2ban or an equivalent. Together they take about ten minutes and eliminate essentially all automated attacks.

Automated attacks begin within minutes of an address going live. They are not targeted at you; they are targeted at everyone, continuously. Password authentication on port 22 is what they are looking for.

The step people skip is the firewall. Default-deny inbound, with explicit allows only for what you actually serve, protects you from the service you forgot was listening — which is how most real intrusions begin.

  • ssh-keygen -t ed25519, upload the public key, then set PasswordAuthentication no
  • PermitRootLogin no; use a normal user with sudo
  • nftables or ufw: default deny inbound, allow 22, 80, 443 and nothing else
  • Enable unattended-upgrades so security patches land without you
  • Install fail2ban, or move SSH behind WireGuard so it is not exposed at all
  • Take a snapshot once it is configured — that becomes your known-good state

See also: fail2ban