Knowledgebase

This is a condensed, copy-paste-ready runbook for securing a brand-new Ubuntu or Debian VPS immediately after deployment, before pointing any real traffic or data at it. For full explanations of each step, follow the linked in-depth guides.

1. Update the System (1 min)

sudo apt update && sudo apt upgrade -y

2. Create a Sudo User (2 min)

adduser deploy
usermod -aG sudo deploy

3. Add Your SSH Key (2 min)

From your local machine:

ssh-copy-id deploy@YOUR_SERVER_IP

4. Harden SSH (3 min)

sudo nano /etc/ssh/sshd_config

Port 2222
PermitRootLogin no
PasswordAuthentication no

sudo sshd -t && sudo systemctl restart ssh

Test in a new terminal window before closing this session.

5. Enable the Firewall (2 min)

sudo apt install ufw -y
sudo ufw allow 2222/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

6. Install Fail2Ban (2 min)

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban

7. Enable Automatic Security Updates (2 min)

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

8. Set the Correct Timezone and Enable NTP (1 min)

sudo timedatectl set-timezone UTC
sudo timedatectl set-ntp true

Final Verification

sudo ufw status
sudo fail2ban-client status
ssh -p 2222 deploy@YOUR_SERVER_IP

What's Deliberately Left Out (Do Next)

This 15-minute pass covers the non-negotiable baseline. Follow up soon with:

• Two-Factor Authentication (2FA) for SSH
• Automated off-site backups
• A scheduled rootkit scan

FAQ

Is this enough for a production server?
It's a strong baseline, but production workloads handling sensitive data should also add 2FA, backups, and log monitoring — all linked below.

Related Articles

• SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
• How to Configure UFW Firewall on a Linux VPS
• How to Install and Configure Fail2Ban
• How to Enable Two-Factor Authentication (2FA) for SSH
• How to Set Up Automated VPS Backups