How to secure your VPS: a complete step-by-step guide

Why it matters

A freshly started VPS is a target. Minutes after it gets a public IP, automated SSH password guessing, port scans and exploit attempts start arriving. This is not paranoia: check the log after half an hour.

bash

grep "Failed password" /var/log/auth.log | tail -20

You will see hundreds of attempts. This guide closes the obvious doors one by one.

The commands are for Ubuntu 24.04, the system Wiptor VPS plans come with.

Step 1: a user without root

Doing everything as root is dangerous. One mistake or a compromised session gives full access. Create a regular user and add it to the sudo group:

bash

adduser admin
usermod -aG sudo admin

Log out and back in as the new user for the remaining steps.

Passwords can be guessed. SSH keys, in practice, cannot. Generate a key pair on your own computer:

bash

ssh-keygen -t ed25519 -C "you@example.com"

Copy the public key to the server:

bash

ssh-copy-id admin@SERVER_IP

Check that key login works before disabling passwords:

bash

ssh admin@SERVER_IP

Step 3: safer SSH settings

On Ubuntu 24.04 it is safer to put your settings in a separate file that updates do not touch:

bash

sudo nano /etc/ssh/sshd_config.d/10-security.conf

Put this in it:

code

Port 2277
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
X11Forwarding no
AllowUsers admin

Port 2277: moving SSH off port 22 gets rid of most automated scanners, which only try the default port. Any port between 1024 and 65535 works.

On Ubuntu 24.04 SSH starts through a socket, so after changing the port run:

bash

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
sudo systemctl restart ssh

Do not close your current session. Open another terminal and check that you can log in on the new port:

bash

ssh -p 2277 admin@SERVER_IP

Step 4: UFW firewall

Set the basic rules:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow the SSH port first. This is critical to do before enabling the firewall, otherwise you lock yourself out:

bash

sudo ufw allow 2277/tcp

If you run a web server:

bash

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Game ports as needed:

bash

sudo ufw allow 25565/tcp
sudo ufw allow 27015/udp
sudo ufw allow 7777/udp

(Minecraft, Source games, a common game port.)

Enable the firewall and check it:

bash

sudo ufw enable
sudo ufw status verbose

Step 5: automatic bans with fail2ban

fail2ban watches logs and automatically bans addresses that behave suspiciously, for example too many failed SSH logins.

bash

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

Create your own settings file (do not edit the original, it is overwritten on updates):

bash

sudo nano /etc/fail2ban/jail.local

Put:

ini

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 3
backend  = systemd

[sshd]
enabled = true
port    = 2277

Restart and check:

bash

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

After three failed attempts, that address is banned automatically for one hour.

Step 6: automatic security updates

Important security patches should install themselves, without you having to remember:

bash

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Choose "Yes". Only security updates are installed automatically, not all updates, which could break something.

Step 7: rootkit checks

rkhunter looks for known rootkits, backdoors and exploits:

bash

sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --check --skip-keypress --report-warnings-only

Run the check weekly. Open sudo crontab -e and add the line:

code

0 3 * * 0 /usr/bin/rkhunter --check --skip-keypress --report-warnings-only

It runs every Sunday at 3 AM. Results are in /var/log/rkhunter.log.

Step 8: safer shared memory

Shared memory can be abused by malicious processes. You can mount it with restrictions:

bash

sudo nano /etc/fstab

Add:

code

tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0

Apply without rebooting:

bash

sudo mount -o remount /dev/shm

Careful: some software (certain databases, for example) needs /dev/shm without restrictions. If something stops starting after this step, remove the line.

Step 9: stop services you do not need

See what is running:

bash

sudo systemctl list-units --type=service --state=running

On a web or game server you usually do not need services like:

bash

sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now cups

Only stop what you are sure you do not use.

Step 10: regular checks

Run these now and then:

bash

who
sudo ss -tulpn
sudo grep "Failed password" /var/log/auth.log | tail -20
sudo fail2ban-client status sshd
sudo apt list --upgradable

(Who is logged in, which ports are open, failed logins, banned addresses and available updates.)

What you have now

After this guide your server has: key-only SSH on a non-standard port, no root login, a firewall that blocks everything you did not allow, automatic bans for password guessing, automatic security updates, weekly rootkit checks and hardened shared memory.

This is not theoretical security. It is the practical baseline that closes exactly the attacks you already see in your logs.

Security at Wiptor

Wiptor DDoS protection stops network-level attacks (traffic floods, UDP attacks, protocol attacks) before they reach your VPS. This guide covers the operating system. Together they cover the two big attack surfaces of a VPS. Your application's security (passwords, up-to-date versions, settings) is the third layer and stays your responsibility.

If you would rather not do all this yourself, our managed services take care of securing and maintaining the server for you.

See Wiptor VPS plans

Was this helpful?

Continue Learning

Recommended next

→

Guide

How to build your own web hosting on a VPS, from A to Z

→

Guide

Gaming, Storage, High Memory or High CPU VPS: what is the real difference?

→