Linux Server Hardening Basics for New VPS Owners

1. SSH keys, password login off

Generate a keypair, add the public key to ~/.ssh/authorized_keys, then set PasswordAuthentication no in sshd_config and restart sshd. Keep one active session open while you test the new login.

2. Firewall: deny by default

Allow SSH (port 22 or your custom port), HTTP/HTTPS, and nothing else to start. Open ports only for services you actually run.

3. Automatic security updates

Enable unattended-upgrades (Ubuntu/Debian) or dnf-automatic (Alma/Rocky) for security patches. Review monthly; reboot when the kernel demands it.

4. fail2ban for SSH

Three wrong passwords in ten minutes should mean a temporary ban. Install fail2ban with the default sshd jail — five minutes of work that kills 99% of brute-force noise.

5. What to leave alone

Do not disable IPv6, SELinux, or the firewall "to make things work". Fix the rule instead. And never expose database ports, panels, or phpMyAdmin to the whole internet without IP restriction.

Want it done for you? Hardening is included with managed setup — ask on WhatsApp.