An unsecured VPS becomes a target of automated attacks within minutes. Bots constantly scan the internet for open SSH ports with default passwords. Follow these steps to secure your server right after installation.
1. Set up SSH keys
Generate an SSH key pair on your local computer:
ssh-keygen -t ed25519
Copy the public key to your server:
ssh-copy-id user@your-server-ip
Disable password login in /etc/ssh/sshd_config:
PasswordAuthentication no
Restart SSH: systemctl restart sshd
2. Configure the firewall (UFW)
UFW is the simplest firewall for Ubuntu/Debian:
ufw default deny incoming- Block everything by default.ufw default allow outgoing- Allow outgoing traffic.ufw allow 22/tcp- Open SSH.ufw allow 25565/tcp- Open your game port (adjust per game).ufw enable- Activate the firewall.
3. Install Fail2ban
Fail2ban blocks IP addresses that make too many failed login attempts:
apt install fail2ban
The default configuration protects SSH right away. For extra protection you can add jails for other services.
4. Automatic updates
Enable automatic security updates:
apt install unattended-upgrades
dpkg-reconfigure unattended-upgrades
Should I change the SSH port?
Changing the SSH port (e.g. to 2222) stops most automated scans. It is not a replacement for key-based authentication, but a useful extra layer.
What if I lock myself out?
Use the VNC console in your hosting panel to log in and fix the SSH configuration. At HostValues, VNC is always available regardless of your SSH configuration.
Is DDoS protection included?
Yes. All HostValues VPS plans include network-level DDoS filtering. This protects against volumetric attacks at no extra cost.
Tip: check out our HostValues view our VPS hosting plans for a fully managed server.