A fresh VPS is exposed to the internet within seconds. Automated bots scan IP ranges continuously, trying default passwords and known exploits. If you do not secure your VPS immediately after installation, it is a matter of days before someone gets in.
Step 1: update everything
apt update && apt upgrade -y
Patches known vulnerabilities. Do this first, before anything else.
Step 2: create a user, disable root login
adduser admin usermod -aG sudo admin
Then edit /etc/ssh/sshd_config:
PermitRootLogin no
Restart SSH: systemctl restart sshd. From now on, log in as your user and use sudo for admin commands.
Step 3: SSH key authentication
Passwords can be brute-forced. SSH keys cannot (practically). On your local machine:
ssh-keygen -t ed25519 ssh-copy-id admin@your-server-ip
Then disable password authentication in /etc/ssh/sshd_config:
PasswordAuthentication no
Restart SSH again. Now only your key can log in.
Step 4: firewall with UFW
ufw default deny incoming ufw default allow outgoing ufw allow ssh ufw enable
Open only the ports you need. For a web server: ufw allow 80 and ufw allow 443. For Minecraft: ufw allow 25565.
Step 5: fail2ban
apt install fail2ban -y systemctl enable fail2ban
fail2ban monitors SSH logs and bans IPs that fail authentication too many times. The default configuration protects SSH out of the box.
Step 6: automatic security updates
apt install unattended-upgrades -y dpkg-reconfigure -plow unattended-upgrades
This automatically installs security patches. You still need to manually update major packages, but critical fixes apply themselves.
Is this enough?
For most use cases, yes. These five steps block the vast majority of automated attacks. If you run a public web application, also consider a web application firewall (ModSecurity) and HTTPS with certbot.
Should I change the SSH port?
It reduces noise in the logs but is not real security. Scanners find non-standard ports quickly. Focus on key-based auth and fail2ban instead.
What about a control panel like cPanel?
Panels add convenience but also attack surface. If you only run a game server or a simple website, the command line is safer and lighter.
All KVM VPS plans at HostValues come with root access and a clean Ubuntu or Debian installation.
