Secure your new VPS

A new VPS is reachable from the whole internet, and bots start guessing passwords within minutes. Spend 20 minutes on these steps right after your first login. The commands are for Ubuntu and Debian; notes for other systems are included.

1. Update everything

apt update && apt upgrade -y

On AlmaLinux, Rocky Linux or CentOS Stream, use dnf upgrade -y. Reboot if the kernel was updated: reboot.

2. Create a normal user with sudo

Working as root all the time is risky. Create your own user (replace alex with your name) and give it admin rights:

adduser alex
usermod -aG sudo alex

If the sudo command is missing (some minimal Debian images), install it first as root with apt install sudo.

On AlmaLinux and Rocky Linux, the admin group is called wheel instead of sudo, and you set the password separately with passwd alex. Log in as the new user in a second window and check that sudo whoami prints root.

3. Log in with an SSH key

A key is far harder to guess than a password. On your own computer (PowerShell, macOS or Linux terminal), create a key pair:

ssh-keygen -t ed25519

Press Enter to accept the default location and choose a passphrase. Then copy the public key to the server. On macOS or Linux:

ssh-copy-id alex@YOUR-IP

On Windows PowerShell (which has no ssh-copy-id):

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh alex@YOUR-IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Now ssh alex@YOUR-IP should log you in without the account password.

4. Turn off password and root login

Only do this after step 3 works. Open the SSH config:

sudo nano /etc/ssh/sshd_config

Set these lines (remove a leading # if there is one):

PermitRootLogin no
PasswordAuthentication no

Files in /etc/ssh/sshd_config.d/ can override the main file, so check them too:

sudo grep -ri "passwordauthentication\|permitrootlogin" /etc/ssh/sshd_config.d/

Change any yes you find there to no. Then test the config and restart SSH:

sudo sshd -t && sudo systemctl restart ssh

On AlmaLinux and Rocky Linux the service is called sshd. Test a new login in a second window before closing the first.

5. Turn on a firewall

On Ubuntu and Debian, ufw is the simplest option. Allow SSH first, then enable it:

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

Open other ports only when you need them, for example sudo ufw allow 80/tcp and sudo ufw allow 443/tcp for a website, or sudo ufw allow 25565/tcp for a Minecraft server. If you changed the SSH port, allow that port instead of OpenSSH. AlmaLinux and Rocky Linux use firewalld (firewall-cmd) instead.

6. Automatic security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Answer Yes to enable automatic installation of security updates. Ubuntu usually has this installed already; the command makes sure it is on.

7. Block repeated login attempts with fail2ban

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

fail2ban watches login failures and temporarily bans IPs that keep guessing. If the last command says the sshd jail doesn't exist, or fail2ban won't start (common on Debian 12, which logs to the systemd journal), create /etc/fail2ban/jail.local with:

[sshd]
enabled = true
backend = systemd

Then run sudo systemctl restart fail2ban.

Windows VPS

• Change the Administrator password to a long, unique one, and never reuse it elsewhere.

• Run Windows Update and leave automatic updates on.

• Keep Windows Defender Firewall on and only open the ports your apps need.

• Don't install software from untrusted sites; it's the most common way Windows servers get infected.

Keep it secure

• Keep regular copies of important data outside the VPS.

• Install only what you need, and remove software you no longer use.

• Turn on two-factor authentication on your billing account too. See How to enable two-factor authentication.

Frequently asked questions