How to Secure a Linux VPS Server: Step-by-Step Guide

To secure a Linux VPS server you need to complete a series of steps in the right order: first lock down SSH access, then enable the firewall, next install brute-force protection, and finally keep the system updated. Completing these steps takes less than an hour and eliminates the vast majority of automated attack vectors that target newly created VPS servers.

This guide covers each step with the exact commands for Debian/Ubuntu-based distributions and their equivalents for CentOS/AlmaLinux/Rocky Linux.

Step 1: SSH Hardening

SSH is the entry point to your server. Securing it is the top priority.

1.1 Create an Admin User and Disable Root

Never manage the server directly as root. Create a user with sudo privileges and disable root SSH login.

adduser adminuser
usermod -aG sudo adminuser

Edit /etc/ssh/sshd_config and set:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

1.2 Use Public-Key Authentication

From your local machine, generate a key pair if you do not have one yet:

ssh-keygen -t ed25519 -C "my-vps-server"

Copy the public key to the server:

ssh-copy-id -i ~/.ssh/id_ed25519.pub adminuser@SERVER_IP

1.3 Change the SSH Port

Add this line to /etc/ssh/sshd_config (choose a port between 1024 and 65535):

Port 2299

Restart SSH only after opening the new port in the firewall to avoid losing access:

systemctl restart sshd

Step 2: Configure the Firewall

A well-configured firewall is the second most important line of defense after SSH.

2.1 UFW (Ubuntu/Debian)

ufw default deny incoming
ufw default allow outgoing
ufw allow 2299/tcp    # custom SSH port
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status verbose

2.2 firewalld (CentOS/AlmaLinux/Rocky)

firewall-cmd --permanent --add-port=2299/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Only open ports you genuinely need. Every exposed service is a potential attack surface.

Step 3: Install Fail2Ban

Fail2Ban monitors system logs and automatically blocks IPs that make too many failed login attempts. It is essential for stopping brute-force attacks.

# Ubuntu/Debian:
apt install fail2ban -y

# CentOS/AlmaLinux/Rocky:
dnf install epel-release -y && dnf install fail2ban -y

Create the local configuration file (never edit jail.conf directly):

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit /etc/fail2ban/jail.local to configure the SSH jail:

[sshd]
enabled = true
port    = 2299
maxretry = 5
bantime  = 3600
findtime = 600

systemctl enable --now fail2ban

Step 4: Keep the System Updated

Linux kernel and system package vulnerabilities are published and exploited within days. Keeping your server updated is one of the most effective yet underrated security measures.

4.1 Manual Updates

# Ubuntu/Debian:
apt update && apt upgrade -y

# CentOS/AlmaLinux/Rocky:
dnf update -y

4.2 Automatic Security Updates

On Ubuntu/Debian, install unattended-upgrades:

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

On CentOS/AlmaLinux/Rocky, use dnf-automatic:

dnf install dnf-automatic -y
# In /etc/dnf/automatic.conf:
apply_updates = yes
systemctl enable --now dnf-automatic.timer

Step 5: Protect Services and Data

5.1 Isolate the Database

MySQL, PostgreSQL, and any database engine should listen only on localhost, never on a public interface.

# In /etc/mysql/mysql.conf.d/mysqld.cnf:
bind-address = 127.0.0.1

5.2 Audit Open Ports and Active Services

Before putting the server into production, verify what is listening on public interfaces:

ss -tlnp

Uninstall or disable any service you do not need.

5.3 Web File Permissions

find /var/www/myapp -type f -exec chmod 644 {} \;
find /var/www/myapp -type d -exec chmod 755 {} \;
chown -R www-data:www-data /var/www/myapp

5.4 Install a Rootkit Scanner

Tools like rkhunter or chkrootkit detect signs of compromise on the server:

apt install rkhunter -y
rkhunter --update && rkhunter --check

Step 6: Set Up Automatic Backups

Security does not end with attack prevention. A working backup can mean the difference between hours of lost work and entire days.

• Provider snapshots: Enable them from your VPS control panel. Typical cost: $1–5 USD/month extra.
• rsync to external server: Schedule a cron job to copy critical data off the server.
• Automated mysqldump: For databases, a daily compressed dump via cron is simple and effective.

# Example cron for MySQL backup:
0 2 * * * mysqldump -u root -p'password' --all-databases | gzip > /backups/db_$(date +\%F).sql.gz

Regularly verify that backups can be restored. A backup you cannot restore is not a backup.

Find more VPS administration and security resources in our VPS servers section.

Key Takeaways

• Block root SSH access from the start and use public-key authentication only.
• Enable the firewall before installing any service and open only necessary ports.
• Install Fail2Ban to automatically block brute-force IPs.
• Keep the system updated; known vulnerabilities are exploited quickly.
• Isolate the database on localhost; never expose it to the internet.
• Set up automatic backups and verify they can be restored.
• Periodically audit open ports and remove unnecessary services.

If you would rather have experts configure and harden your VPS without dealing with any of the technical details yourself, elenlace.com offers server setup and hardening services tailored to your business needs.

FAQ

How long does it take to secure a new VPS?

Following the steps in this guide takes between 45 and 90 minutes on a clean server. The critical steps (SSH + firewall + Fail2Ban) can be completed in under 30 minutes.

Do I need a dedicated server to apply these measures?

No. Every measure in this guide applies equally to VPS (virtual) servers and dedicated servers. They are independent of the underlying hardware.

Can Fail2Ban accidentally block my own IP?

Yes, if you make several password mistakes. To prevent this, add your IP to the whitelist in /etc/fail2ban/jail.local with the directive ignoreip = 127.0.0.1/8 YOUR_STATIC_IP. If you do get locked out, you can unblock your IP from the provider's emergency console.

How often should I review server security?

Review authentication logs and firewall status weekly. Run rkhunter monthly. Apply system updates as soon as security patches are available, ideally with automation enabled.

Prefer it done for you? El Enlace handles hosting and professional web development.

Compare providers

Other providers and guides worth comparing:

• HubSpot
• IONOS
• GoDaddy