An unsecured server is an open invitation for attackers. Within minutes of going online, your server is already being scanned for vulnerabilities. With this checklist, you secure your Linux server against the most common attacks.
1. Secure SSH
SSH is the most attacked service on any server. Secure it first:
- Change the SSH port: change the default port 22 to a high port number (e.g., 2222 or 49152). This stops automated scans.
- Use SSH keys: disable password authentication and use SSH keys. Generate a key with
ssh-keygen -t ed25519. - Disable root login: set
PermitRootLogin noand use a regular user with sudo privileges. - Install Fail2Ban: bans IP addresses that fail too many login attempts.
Adjust these settings in /etc/ssh/sshd_config and restart SSH: systemctl restart sshd.
2. Set up a firewall
Only allow the traffic you need. Use UFW (Uncomplicated Firewall):
ufw default deny incoming ufw default allow outgoing ufw allow 2222/tcp # SSH (your port) ufw allow 80/tcp # HTTP ufw allow 443/tcp # HTTPS ufw enable
Only open ports you actually use. For a game server, add the game ports.
3. Automatic updates
Security updates should be installed automatically:
apt install unattended-upgrades dpkg-reconfigure -plow unattended-upgrades
This installs security patches automatically as soon as they become available.
4. User management
- Create a separate user for daily management:
adduser admin. - Grant sudo rights:
usermod -aG sudo admin. - Remove unused accounts.
- Use strong, unique passwords (or better: SSH keys only).
5. Minimize services
Only run software you need. Check what is running:
ss -tulpn systemctl list-units --type=service --state=running
Disable unnecessary services: systemctl disable [service] && systemctl stop [service].
6. Backups
No backup = no server. Set up automatic backups:
- Daily backups of databases and configuration.
- Weekly full backups.
- Store backups in a different location (not on the same server).
- Regularly test that you can restore your backups.
7. Monitoring
- Logwatch: daily summary of log files via email.
- Netdata: real-time monitoring of CPU, RAM, disk, and network.
- Lynis: security audit tool that scans your server and makes recommendations.
Checklist summary
| Step | Priority | Status |
|---|---|---|
| Change SSH port | High | [ ] |
| Set up SSH keys | High | [ ] |
| Disable root login | High | [ ] |
| Install Fail2Ban | High | [ ] |
| Configure firewall (UFW) | High | [ ] |
| Automatic updates | High | [ ] |
| Create separate user | Medium | [ ] |
| Disable unnecessary services | Medium | [ ] |
| Configure backups | High | [ ] |
| Install monitoring | Medium | [ ] |
Is a VPS secure enough without these steps?
No. A default VPS installation has minimal security. Without a firewall and SSH hardening, your server will be found within hours by automated scanners running brute-force attacks.
How do I know if my server has been hacked?
Watch for: unexplained high CPU usage (cryptomining), unknown processes, modified files, new user accounts, or outgoing traffic to unknown addresses. Check with last, who, ps aux, and netstat -tulpn.
Should I get managed hosting if I have no Linux experience?
If you lack the time or knowledge to secure your server, managed hosting is a smart choice. You pay more, but someone else handles updates, security, and monitoring.
Check out our VPS hosting at HostValues with DDoS protection and NVMe storage.
