How to Secure a New Linux VPS: First Steps Checklist

1. Update the system

The first thing to do after logging in is to install the latest security updates. On Ubuntu and Debian:

apt update && apt upgrade -y

On AlmaLinux and Rocky Linux:

dnf upgrade -y

2. Create a regular user with sudo

Working as root every day is risky. Create a user and add it to the sudo group (wheel on AlmaLinux and Rocky):

adduser myuser
usermod -aG sudo myuser

3. Log in with an SSH key

Create a key on your computer and copy it to the new user (full guide: connecting with SSH):

ssh-copy-id myuser@IP

4. Turn off password and root login

Only once you are sure the key works, edit /etc/ssh/sshd_config and set:

PasswordAuthentication no
PermitRootLogin no

Then restart SSH (systemctl restart ssh on Ubuntu and Debian, systemctl restart sshd on AlmaLinux and Rocky). Before closing your current session, test logging in from a new window so you don't lock yourself out.

5. Enable a firewall

On Ubuntu and Debian, open only the ports you need with ufw:

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

On AlmaLinux and Rocky use firewalld: firewall-cmd --permanent --add-service=ssh, then firewall-cmd --reload.

6. Stop password guessing

fail2ban temporarily bans IPs that keep entering wrong passwords:

apt install fail2ban -y

7. Automatic security updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

8. Backups and monitoring

• Back up important data regularly and keep the backups outside the server.
• Watch your traffic on the server page; a sudden jump can be a sign of abuse.
• If you think the server password leaked, change it right away from the server page.

Need a new Linux server? See the Linux VPS page.