VPS Tutorials
VPS Security Hardening Guide: The First Thing to Do After Getting a Server (SSH + Firewall + Fail2Ban)
Don't rush to install a control panel when you get a new VPS. This article shares a standard 4-step security hardening process: change the SSH port, configure key-based login, enable the UFW firewall, and install Fail2Ban. In just 15 minutes, you can keep your server safe from brute-force attacks and botnet recruitment.
Many people, the first thing they do when they get a VPS, is install the BaoTa panel or Docker, then eagerly start running services.
Stop! Not so fast.
Do you know how dangerous it is to leave your VPS exposed on the public internet? I once checked the logs on a freshly purchased machine and found hundreds of SSH brute-force attempts within 10 minutes. If your password is set a little too simply (like 123456 or root), it may already have been scanned and turned into a "bot" for crypto mining by now.
As a seasoned user, for the first 15 minutes after getting a new VPS, I do one thing without fail: security hardening.
Today I'll share the standard operating procedure (SOP) I've used for 5 years. Just 4 steps to make your server rock solid.
The default SSH port is 22, and hackers' scripts scan this port 24 hours a day.
Recommended approach: use key-based login and disable password authentication.
- Generate a key pair (if you don't have one yet):
Open a terminal on your computer (PowerShell or CMD):
ssh-keygen -t rsa -b 4096 - Upload the public key to the VPS:
# 替换成你的 IP ssh-copy-id [email protected] - Edit the sshd configuration file:
Log in to the VPS and edit
/etc/ssh/sshd_config:
Find and modify the following items:vi /etc/ssh/sshd_configPort 2222 # 改个非标准端口，比如 2222 PermitRootLogin prohibit-password # 禁止 root 用密码登录（只准用密钥） PasswordAuthentication no # 彻底关闭密码认证 - Restart the service:
Note: Don't log out right after making changes! Open a new terminal window and test whether you can connect, so you don't lock yourself out.systemctl restart sshd
Linux's built-in iptables is powerful but hard to use. I recommend UFW (Uncomplicated Firewall).
Install on Debian/Ubuntu:
apt update && apt install ufw -y
Set the rules (order matters!):
# 1. 默认拒绝所有进入连接
ufw default deny incoming
# 2. 允许所有出去的连接
ufw default allow outgoing
# 3. 放行刚才修改的 SSH 端口 (比如 2222)
ufw allow 2222/tcp
# 4. 放行 Web 服务端口 (如果你做网站的话)
ufw allow 80/tcp
ufw allow 443/tcp
# 5. 启动防火墙
ufw enable
Fail2Ban is a great tool. It monitors logs, and when it detects someone repeatedly trying passwords, it directly blacklists their IP.
Install:
apt install fail2ban -y
Its default configuration works out of the box and protects SSH. You can fine-tune it in /etc/fail2ban/jail.local, for example changing "5 wrong passwords" to "3 times" to ban the IP.
After installing, check with fail2ban-client status sshd. After a few days you'll find there may be quite a few IPs in the "Current Banned" list—all of them handing themselves over.
Vulnerabilities are scarier than hackers. To prevent forgetting to update the system, we can enable automatic security updates.
For Debian/Ubuntu:
apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades
Select "Yes" and you're done. It will automatically install security patches, so you don't need to worry about it.
After completing these 4 steps:
- Key login + changed port -> 99% of scanning scripts become useless.
- UFW firewall -> close unnecessary doors.
- Fail2Ban -> automatically ban malicious IPs.
- Automatic updates -> patch vulnerabilities in time.
As long as your private key isn't leaked, this VPS is basically an iron fortress. Security is never absolute, but at least don't be the "softest persimmon to squeeze."