---
title: "Secure your new VPS"
url: https://help.endercloud.in/docs/secure-your-new-vps
category: "VPS Hosting"
type: Guide
tags: ["linux", "security", "ssh", "vps", "windows"]
keywords: "ufw, firewall, fail2ban, ssh key, ssh-keygen, disable root login, passwordauthentication no, unattended-upgrades, sudo user, adduser, brute force ssh, hardening ubuntu, vps hacked, windows vps security, secure vps, vps security, harden vps, protect vps, ufw setup, ssh key login, block brute force, secure linux server"
difficulty: intermediate
time: "20 minutes"
updated: 2026-11-14
source: Endercloud Knowledge Base (official)
---

# Secure your new VPS

> Update the system, create a sudo user, log in with SSH keys, turn on a firewall (ufw), enable automatic security updates and install fail2ban. Windows tips included.

A new VPS is reachable from the whole internet, and bots start guessing passwords within minutes. Spend 20 minutes on these steps right after your first login. The commands are for **Ubuntu and Debian**; notes for other systems are included.

> **Warning:**
> Keep your current SSH session open while you change SSH or firewall settings, and test with a **second** session before logging out. If you do lock yourself out, use the web console on your VPS page (billing panel → **Servers** → **Manage**) where available, or reset the password.

## 1\. Update everything

```
apt update && apt upgrade -y
```

On AlmaLinux, Rocky Linux or CentOS Stream, use `dnf upgrade -y`. Reboot if the kernel was updated: `reboot`.

## 2\. Create a normal user with sudo

Working as root all the time is risky. Create your own user (replace `alex` with your name) and give it admin rights:

```
adduser alex
usermod -aG sudo alex
```

If the `sudo` command is missing (some minimal Debian images), install it first as root with `apt install sudo`.

On AlmaLinux and Rocky Linux, the admin group is called `wheel` instead of `sudo`, and you set the password separately with `passwd alex`. Log in as the new user in a second window and check that `sudo whoami` prints `root`.

## 3\. Log in with an SSH key

A key is far harder to guess than a password. On **your own computer** (PowerShell, macOS or Linux terminal), create a key pair:

```
ssh-keygen -t ed25519
```

Press Enter to accept the default location and choose a passphrase. Then copy the public key to the server. On macOS or Linux:

```
ssh-copy-id alex@YOUR-IP
```

On Windows PowerShell (which has no `ssh-copy-id`):

```
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh alex@YOUR-IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
```

Now `ssh alex@YOUR-IP` should log you in without the account password.

## 4\. Turn off password and root login

Only do this after step 3 works. Open the SSH config:

```
sudo nano /etc/ssh/sshd_config
```

Set these lines (remove a leading `#` if there is one):

```
PermitRootLogin no
PasswordAuthentication no
```

Files in `/etc/ssh/sshd_config.d/` can override the main file, so check them too:

```
sudo grep -ri "passwordauthentication\|permitrootlogin" /etc/ssh/sshd_config.d/
```

Change any `yes` you find there to `no`. Then test the config and restart SSH:

```
sudo sshd -t && sudo systemctl restart ssh
```

On AlmaLinux and Rocky Linux the service is called `sshd`. Test a new login in a second window before closing the first.

## 5\. Turn on a firewall

On Ubuntu and Debian, **ufw** is the simplest option. Allow SSH **first**, then enable it:

```
sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status
```

Open other ports only when you need them, for example `sudo ufw allow 80/tcp` and `sudo ufw allow 443/tcp` for a website, or `sudo ufw allow 25565/tcp` for a Minecraft server. If you changed the SSH port, allow that port instead of `OpenSSH`. AlmaLinux and Rocky Linux use `firewalld` (`firewall-cmd`) instead.

## 6\. Automatic security updates

```
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
```

Answer **Yes** to enable automatic installation of security updates. Ubuntu usually has this installed already; the command makes sure it is on.

## 7\. Block repeated login attempts with fail2ban

```
sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd
```

fail2ban watches login failures and temporarily bans IPs that keep guessing. If the last command says the `sshd` jail doesn't exist, or fail2ban won't start (common on Debian 12, which logs to the systemd journal), create `/etc/fail2ban/jail.local` with:

```
[sshd]
enabled = true
backend = systemd
```

Then run `sudo systemctl restart fail2ban`.

## Windows VPS

-   Change the Administrator password to a long, unique one, and never reuse it elsewhere.
    
-   Run **Windows Update** and leave automatic updates on.
    
-   Keep **Windows Defender Firewall** on and only open the ports your apps need.
    
-   Don't install software from untrusted sites; it's the most common way Windows servers get infected.
    

## Keep it secure

-   Keep regular copies of important data outside the VPS.
    
-   Install only what you need, and remove software you no longer use.
    
-   Turn on two-factor authentication on your billing account too. See [How to enable two-factor authentication](/docs/how-to-enable-two-factor-authentication).
    

## Frequently asked questions

**Q: Is my VPS protected against DDoS attacks?**

Yes, all Endercloud VPS include DDoS protection. That protects the network, but it doesn't stop password guessing or software bugs, so these steps are still important.

**Q: I enabled ufw and now SSH doesn't connect**

SSH wasn't allowed before enabling the firewall. Open the web console on your VPS page (billing panel → **Servers** → **Manage**) where available, log in, and run `sudo ufw allow OpenSSH`. Otherwise open a ticket.

**Q: I think my VPS was hacked. What should I do?**

Copy off the data you need, reinstall the OS, change all passwords, and follow this guide before going online again. See [Reinstall the OS](/docs/reinstall-os-and-reset-root-password).