Essential VPS security hardening checklist

Priority 1 — Do these immediately

1. Update all packages

apt update && apt full-upgrade -y    # Debian / Ubuntu
dnf update -y                        # AlmaLinux / Rocky

2. Create a non-root admin user

adduser deploy
usermod -aG sudo deploy

3. Configure SSH key authentication

On your local machine:

ssh-keygen -t ed25519 -C "my-vps-key"
ssh-copy-id deploy@YOUR_VPS_IP

4. Harden SSH configuration

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers deploy
MaxAuthTries 3

Restart: systemctl restart sshd

5. Enable and configure UFW

See the Configuring a software firewall article for full details.

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw enable

Priority 2 — Highly recommended

6. Install Fail2ban

apt install fail2ban
systemctl enable --now fail2ban

Fail2ban watches auth logs and automatically blocks IPs after repeated failed login attempts.

7. Enable automatic security updates

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

8. Disable unused services

systemctl list-units --type=service --state=running
# Disable anything you don't need, e.g.:
systemctl disable --now avahi-daemon

Priority 3 — For production workloads

9. Configure log shipping

Ship logs to an external service (Papertrail, Logtail, Loki) so you have an audit trail even if the VPS is compromised.

10. Set up a vulnerability scanner

Lynis is a free, open-source security audit tool:

apt install lynis
lynis audit system

Review the suggestions in the report and address items rated [WARNING] first.