VPS hardening checklist.

1. Update and create a normal user

apt update && apt full-upgrade -y
adduser deploy
usermod -aG sudo deploy

2. SSH keys only

Keep a second session open when you reload SSH, so a mistake does not lock you out. The out-of-band console is your fallback.

# from your laptop
ssh-copy-id deploy@YOUR-SERVER-IP
# then on the server, in /etc/ssh/sshd_config.d/10-hardening.conf
PasswordAuthentication no
PermitRootLogin no
systemctl reload ssh

3. Firewall

Open further ports only for services you run.

apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw enable

4. Automatic security updates

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

5. Reduce what is running

List listening services with ss -tlnp and remove or bind to localhost anything you do not need.

6. Brute-force protection

With keys only, brute force cannot succeed, but fail2ban reduces log noise: apt install -y fail2ban.

7. Back up off the server

Use an encrypted backup tool to a different location. Test a restore. A backup you have not restored is a hope, not a backup.

Check your work

1. Open a second terminal and confirm you can still log in before closing the first.
2. Run ss -tulpn and check that only expected ports listen.
3. Review /var/log/auth.log for failed attempts.
4. Reboot once and confirm services return.

Keep going

Hardening is not a one-time task. Apply updates, review users and remove software you no longer use. For stored data, consider full-disk encryption.

Common questions