VPS security
VPS server security, a hardening checklist
A new VPS starts open and unconfigured. This checklist walks through the changes that close off the most common ways a server gets compromised, in the order to make them.
10 hardening steps and a quick checklist
Hardening checklist
Harden a new VPS in ten steps.
- 1
Update the operating system
Run the system's update command as soon as the server is up, and again on a regular schedule. Most compromises use a known, already-patched vulnerability.
- 2
Switch to SSH keys and disable password login
Generate an SSH key pair, add the public key to the server, then turn off password authentication in the SSH configuration so keys are the only way in.
Also disable root login over SSH once another admin user works.
- 3
Change the defaults
Rename or remove default accounts where possible, and consider moving SSH off port 22 to cut down on automated scans, alongside the other steps here rather than instead of them.
- 4
Set up a firewall
Use ufw or nftables to block every port you are not using, and only open what your applications actually need, such as 80 and 443 for a website.
- 5
Install fail2ban
Fail2ban watches for repeated failed logins and temporarily blocks the source, which cuts down brute-force attempts on SSH and other services.
- 6
Create least-privilege users
Avoid working as root day to day. Create a normal user with sudo access for admin tasks, and separate accounts for anyone else who needs access.
- 7
Turn on automatic security updates
Most Linux distributions can install security patches automatically, so you are covered between the updates you run yourself.
- 8
Back up the server, and take snapshots
Keep a working backup of your data, and take a snapshot before any major change. Cloudoora droplets can use snapshots to restore a whole server.
A snapshot taken just before an update is the fastest way back if it goes wrong.
- 9
Review logs for anything unusual
Check your authentication and application logs occasionally, and after anything odd, such as a slowdown or an unexpected restart.
- 10
Put applications behind SSL
Any site or app you run should serve traffic over HTTPS, so data between your visitors and the server is encrypted.
Quick checklist
Is your VPS hardened?
Do
- Login by SSH key only
Password and root login over SSH are both switched off.
- Firewall rules set
Only the ports your applications need are open.
- Automatic security updates on
Patches apply even when you forget to check.
- Backups and snapshots current
Taken regularly, and before any major change.
Avoid
- Running everything as root
One mistake or exploit then has full control of the server.
- Leaving default settings in place
Automated scans look for exactly those defaults.
- Skipping updates to avoid downtime
An unpatched, known vulnerability is a bigger risk than a short update window.
- No record of what changed
Makes it harder to spot or undo a problem later.
Related guides
Keep your VPS running well
- How to secure a VPS server
The full walkthrough behind this checklist.
- VPS server monitoring tools
Tools for watching your server's health yourself.
- VPS disaster recovery plan
Steps for getting a server back after something goes wrong.
- VPS backups, best practices
How often to back up, and what to keep.
- Optimize VPS performance
Get more speed from the resources you already have.
- VPS hosting
Plans billed hourly or monthly, by resource.
FAQ
VPS security questions
What is the first thing I should do on a new VPS?
Update the operating system, then set up SSH key login and a firewall before putting anything live on it.
Should I disable root login?
Yes, once you have another admin account with sudo access working. Logging in directly as root removes a layer of protection.
What is fail2ban for?
It watches login attempts and temporarily blocks a source after too many failures, which reduces brute-force attacks on SSH and other services.
How often should I back up my VPS?
Regularly on a schedule, and always before a major change, such as an upgrade. On Cloudoora droplets, use snapshots for this.
Is a firewall enough on its own?
No. It is one part of hardening a server, alongside SSH keys, updates, least-privilege users and backups.
Where can I get help securing a VPS?
Chat with our support team, or read the full walkthrough.
Ready for a VPS of your own?
VPS plans from €3.87, billed hourly or monthly.