Every new VPS is deployed with default settings that are convenient but not secure. This checklist walks through the essential hardening steps every server should have before running production workloads — and links to a full guide for each one.
1. Update the System Immediately
sudo apt update && sudo apt upgrade -y2. Create a Non-Root Sudo User
Never operate day-to-day as root. See: How to Create a New User with Sudo Access.
3. Set Up SSH Key Authentication
Disable password logins entirely once keys are confirmed working.
4. Change the Default SSH Port and Disable Root Login
See: SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys.
5. Enable a Firewall (UFW)
Deny by default, allow explicitly. See: How to Configure UFW Firewall on a Linux VPS.
6. Install Fail2Ban
Automatically bans IPs after repeated failed login attempts. See: How to Install and Configure Fail2Ban.
7. Enable Two-Factor Authentication
Adds a second verification layer beyond SSH keys. See: How to Enable Two-Factor Authentication (2FA) for SSH.
8. Enable Automatic Security Updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades9. Set Up Automated Backups
See: How to Set Up Automated VPS Backups.
10. Monitor Authentication Logs
Regularly check for suspicious login attempts. See: How to Monitor Auth Logs and Detect Intrusion Attempts.
11. Scan for Rootkits and Malware Periodically
See: How to Detect and Remove Rootkits on a Linux VPS.
12. Remove Unused Services and Close Unnecessary Ports
sudo ss -tulpnAnything listening that you don't recognize should be investigated and disabled if unnecessary.
Quick Reference Table
| Step | Priority | Time Required |
|---|---|---|
| System updates | Critical | 5 min |
| Sudo user + SSH keys | Critical | 10 min |
| Firewall (UFW) | Critical | 10 min |
| Fail2Ban | High | 10 min |
| 2FA | Recommended | 10 min |
| Automated backups | Critical | 15 min |
FAQ
How often should I revisit this checklist?
Review it after every major deployment, and audit logs/updates on a monthly basis at minimum.
Is a firewall enough on its own?
No — a firewall controls network access, but Fail2Ban, updates, and backups each cover different failure modes.
Related Articles
- SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
- How to Configure UFW Firewall on a Linux VPS
- How to Install and Configure Fail2Ban
- How to Set Up Automated VPS Backups
