How to secure a VPS in 5 steps

A new VPS arrives with a basic installation of the operating system, and within minutes of going online it starts receiving automated login attempts. Securing a VPS means closing the doors those attacks try first: weak passwords, exposed SSH, open ports, missing backups and unpatched software. These five steps take about an hour and apply to any Linux distribution, on a VPS as on a dedicated server.

The examples use the two families you are most likely to find: Debian and Ubuntu (apt, ufw) and AlmaLinux and Rocky Linux (dnf, firewalld).

1. Use SSH keys and a non-root user

The first thing to protect is the way in. Brute-force attacks try common passwords from dictionaries, and a short root password can fall quickly. Two changes remove most of that risk.

Create a normal user with administrator rights, and use it instead of root:

adduser alice
usermod -aG sudo alice      # Debian, Ubuntu
usermod -aG wheel alice     # AlmaLinux, Rocky Linux
passwd alice                # AlmaLinux, Rocky Linux

On AlmaLinux and Rocky Linux adduser creates the user without a password: passwd sets the one that sudo asks for.

Then log in with an SSH key instead of a password. Generate the key on your computer and copy it to the server:

ssh-keygen -t ed25519
ssh-copy-id alice@your-server

If you still need passwords somewhere (email accounts, FTP, control panels), make them long and random: at least 16 characters, mixing upper and lower case letters, numbers and symbols, ideally generated by a password manager.

2. Lock down SSH access

Once key login works, tell the SSH server to refuse passwords and direct root logins. Current Debian, Ubuntu, AlmaLinux and Rocky Linux releases read the files in /etc/ssh/sshd_config.d/ before the main configuration, and for each setting the first value read wins: some server images place a file there that enables password login again. Write the two settings in a file that sorts first, such as /etc/ssh/sshd_config.d/00-hardening.conf:

PasswordAuthentication no
PermitRootLogin no

Check the syntax with sudo sshd -t, then restart the service with sudo systemctl restart ssh (on AlmaLinux and Rocky Linux the service is called sshd). Keep your current session open and test a new login from a second terminal before closing it, so a typing mistake does not lock you out.

Changing the SSH port from 22 to another number, the advice of the original article, is still possible: it reduces the noise of automated scans in your logs, but it is not a protection in itself. The real protection is key-only login.

3. Configure a firewall and brute-force protection

A firewall lets through only the services that must be reachable from outside, and closes ports opened by mistake. Distributions ship their own tool, which is simpler to maintain than hand-written rules.

On Debian and Ubuntu, ufw is the default tool and is disabled after installation:

sudo ufw allow ssh
sudo ufw allow 80,443/tcp
sudo ufw enable

On AlmaLinux and Rocky Linux the equivalent is firewalld:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

To block addresses that keep failing logins, add fail2ban, which reads the logs and bans them for a set time. The original article recommended CSF (ConfigServer Security and Firewall): its vendor closed on 31 August 2025 and the software now lives on as open source forks, so on a new server the distribution's own tools are the safer choice.

4. Back up, and test the restore

A secure server can still lose data: an accidental deletion, a broken update, ransomware that gets in through an application. Schedule regular backups kept away from the server, and test a restore now and then: a backup that has never been restored is not yet a backup. If you would rather not build it yourself, our cloud backup for business keeps immutable copies in Italy or in the EU, as you choose.

5. Keep the system updated

Most security fixes arrive as ordinary package updates, so check and apply them regularly, starting right after the first installation:

sudo apt update && sudo apt upgrade     # Debian, Ubuntu
sudo dnf upgrade --refresh              # AlmaLinux, Rocky Linux

On Ubuntu Server, automatic security updates (unattended-upgrades) are installed and enabled by default; on AlmaLinux and Rocky Linux you can get the same with dnf-automatic.

Is that enough to secure a VPS?

No: these five steps are the foundation, not the end of the job. Security also depends on the applications you install, on the services you expose and on someone watching the logs. The same checklist applies to a dedicated server.

To delegate this work, pair our Linux VPS hosting with the systems management service (in Italian): system hardening, periodic operating system updates and monitoring of servers and services, carried out by our systems engineers. Backup is a separate service.

Choose a Linux VPS · Talk to an expert