Linux Server Security: 10 Steps to Take on a New VPS

When you spin up a new VPS, your server's IP address becomes visible to everyone on the internet. Within minutes, automated bots from all over the world start trying to log in via SSH, looking for weak passwords. It's nothing personal; bots scan every IP. The good news is that a few simple steps will stop nearly all of these attacks.

The commands below are for Ubuntu and Debian. We assume you're running them as root.

1. Update the system

Most security holes are closed by updates.

apt update && apt upgrade -y

2. Set a strong password

Use a password that's at least 16 characters long and includes letters, numbers, and symbols. A password manager makes this much easier.

passwd

3. Create a separate user for everyday tasks

Instead of doing everything as root, create a user with administrator privileges:

adduser john
usermod -aG sudo john

4. Switch to SSH key login

Passwords can be guessed; SSH keys are practically impossible to guess. We explain how to create a key step by step in our SSH guide.

5. Disable password and root logins over SSH

Only after confirming that key-based login works, set the following lines in the /etc/ssh/sshd_config file:

PermitRootLogin no
PasswordAuthentication no

Then restart the service:

systemctl restart ssh

Before this step, test in a new terminal window that you can log in with your key. Otherwise, you could lock yourself out of the server.

6. Turn on the firewall (UFW)

Allow only the ports you need:

apt install ufw -y
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

You can view the rules with the ufw status command.

7. Block brute-force attacks with Fail2ban

Fail2ban automatically blocks, for a period of time, IP addresses that repeatedly fail to log in:

apt install fail2ban -y
systemctl enable --now fail2ban

8. Enable automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades

9. Turn off unnecessary services

Every service you don't use is a door for attackers. To see which ports are open to the outside:

ss -tulpn

Turn off any service you don't need with systemctl disable --now SERVICENAME. If possible, set your database (MySQL, PostgreSQL, Redis) to listen only on 127.0.0.1.

10. Make regular backups

No security measure is 100% foolproof. Your real insurance is a backup. Regularly back up your important files and database to a location off the server, and test restoring from a backup at least once.

Bonus: For your website

• Always serve your site over HTTPS.
• Keep platforms like WordPress and their plugins up to date.
• Delete plugins and themes you don't use.

Frequently Asked Questions

How can I tell if my server is being attacked?

You can see failed login attempts in the /var/log/auth.log file. Unexpectedly high CPU usage, processes you don't recognize, or new users are also warning signs.

Will turning on the firewall lock me out?

If you add the ufw allow OpenSSH rule before running ufw enable, your SSH connection won't be cut off. Even if something goes wrong, you can still reach your server through the console in the customer panel.

Do I need to install antivirus software?

On Linux servers, the real risks are less about viruses and more about weak passwords, outdated software, and services left exposed. The steps above are far more effective.

Are these steps necessary for shared hosting too?

No. With shared hosting, the provider takes care of server security. Your responsibility is to use strong passwords and keep your site's software up to date.