VPS guide

How to Secure a Linux VPS: The First Steps That Matter

By Gander Web · Updated 11 October 2026 · 2 min read

Bots start probing a new server within minutes. To secure a Linux VPS, lock down access, patch it, and put a firewall in front before you do anything else, in this order.

Use SSH keys and disable password login

Set up SSH key authentication and turn off password logins entirely. Keys are far harder to brute-force than passwords and stop the most common automated attacks dead. From your own computer:

ssh-copy-id you@your-vps-ip

Check you can log in with the key, then set PasswordAuthentication no in /etc/ssh/sshd_config and restart SSH with sudo systemctl restart ssh. Files in /etc/ssh/sshd_config.d/ can override that setting, so check them too.

Disable root login and create a sudo user

Log in as a normal user with sudo rather than root. It limits the damage if an account is ever compromised and removes the obvious 'root' target attackers hammer. Create the user and test it before you lock root out:

adduser yourname
usermod -aG sudo yourname

Then set PermitRootLogin no in the SSH config and restart SSH.

Set up a firewall and keep it updated

Allow only the ports you use (SSH, HTTP, HTTPS) with a firewall like UFW. Allow SSH before you enable it, or you'll lock yourself out:

sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable

Then apply security updates promptly, and turn on automatic security updates with sudo apt install unattended-upgrades. Out-of-date software is a common way servers get breached. See protecting your website from hackers.

Add fail2ban and back up

Install fail2ban (sudo apt install fail2ban) to block addresses after repeated failed logins. On Ubuntu it protects SSH as soon as it's installed. Then set up off-site backups so you can recover fast: unmanaged VPS plans don't include them. Prefer not to manage all this? A managed VPS keeps it hardened and patched for you.

Questions

Related guides