VPS Security Hardening Guide: Protect Your Linux Server in 2026

By CloudPicked Review Team · Updated September 2026

Internet scanners like Shodan and countless automated bots continuously probe VPS servers for misconfigured services around the clock. Without proper security hardening, a new VPS can be compromised within hours of deployment. This guide covers both fundamental and advanced hardening steps for Linux VPS (Ubuntu/Debian) that you should perform immediately after deployment.

1. Update the System First

Before anything else, update all packages to close known vulnerabilities:

sudo apt update && sudo apt upgrade -y
sudo apt dist-upgrade -y
sudo apt autoremove -y

For CentOS/AlmaLinux/Rocky Linux:

sudo dnf update -y
sudo dnf upgrade -y

Configure automatic security updates to keep the system patched:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

2. Create a New User and Disable Root Login

Logging in directly as root is one of the most common vulnerabilities. The username root is the first one attackers try.

Create a New Sudo User

# Create a new user (replace yourusername)
sudo adduser yourusername

# Add to sudo group
sudo usermod -aG sudo yourusername

# Test login with the new user BEFORE disabling root

Disable Root SSH Login

sudo nano /etc/ssh/sshd_config

# Find and change:
PermitRootLogin no

sudo systemctl restart sshd

3. Set Up SSH Key Authentication

SSH keys are far stronger than passwords, using cryptographic key pairs that are practically impossible to brute-force.

Generate an SSH Key on Your Local Machine

# Generate ed25519 key (recommended over RSA 4096 — more secure and faster)
ssh-keygen -t ed25519 -C "[email protected]"

# Keys saved at ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public)

Copy the Public Key to Your Server

# Method 1: Using ssh-copy-id (easiest)
ssh-copy-id -i ~/.ssh/id_ed25519.pub yourusername@YOUR_SERVER_IP

# Method 2: Manual copy
cat ~/.ssh/id_ed25519.pub | ssh yourusername@YOUR_SERVER_IP \
  "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Disable Password Authentication

After confirming key-based login works, disable password authentication:

sudo nano /etc/ssh/sshd_config

# Change or add:
PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart sshd

4. Change the SSH Port

Port 22 is known to every scanner. Changing to a non-standard port dramatically reduces automated brute-force noise in your logs (though it is not a security control by itself).

sudo nano /etc/ssh/sshd_config

# Change to a custom port (e.g. 2222 or a high port 49152-65535)
Port 2222

sudo systemctl restart sshd

5. Configure UFW Firewall

UFW (Uncomplicated Firewall) is an easy-to-use front-end for iptables. Open only the ports you actually need.

sudo apt install ufw -y

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow your SSH port (critical!)
sudo ufw allow 2222/tcp comment 'SSH custom port'

# Allow web traffic if needed
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Enable UFW
sudo ufw enable

# Check status
sudo ufw status verbose

Additional Useful Rules

# Rate-limit SSH connections (brute-force protection)
sudo ufw limit 2222/tcp

# Allow from a specific IP only
sudo ufw allow from 1.2.3.4 to any port 2222

# List numbered rules
sudo ufw status numbered

# Delete a rule by number
sudo ufw delete 3

6. Install and Configure fail2ban

fail2ban monitors log files and automatically bans IPs that repeatedly fail authentication, providing an important layer of defence against brute-force attacks.

sudo apt install fail2ban -y

# Back up original config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.bak

# Create a local override config
sudo nano /etc/fail2ban/jail.local

Add the following content to jail.local:

[DEFAULT]
bantime  = 3600      ; ban for 1 hour
findtime = 600       ; look back 10 minutes
maxretry = 5         ; ban after 5 failures
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled  = true
port     = 2222      ; match your custom SSH port
logpath  = /var/log/auth.log
maxretry = 3         ; stricter for SSH

sudo systemctl enable fail2ban
sudo systemctl restart fail2ban

# Check status
sudo fail2ban-client status
sudo fail2ban-client status sshd

# Unban an IP
sudo fail2ban-client set sshd unbanip 1.2.3.4

7. Disable Unnecessary Services

Every running service is an additional attack surface. Audit and disable what you do not need:

# List running services
sudo systemctl list-units --type=service --state=running

# List open ports
sudo ss -tlnp

# Disable an unneeded service (example: avahi-daemon if not using mDNS)
sudo systemctl disable --now avahi-daemon

8. Harden Kernel Parameters (sysctl)

Tune kernel parameters to defend against network-level attacks:

sudo nano /etc/sysctl.d/99-security.conf

Add:

# Anti IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable IP forwarding (if not a router)
net.ipv4.ip_forward = 0

# Disable ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0

# Log martian packets
net.ipv4.conf.all.log_martians = 1

# SYN flood protection
net.ipv4.tcp_syncookies = 1

sudo sysctl -p /etc/sysctl.d/99-security.conf

9. Install Security Auditing Tools

Lynis (Security Audit)

sudo apt install lynis -y
sudo lynis audit system

Lynis generates a comprehensive security report with a Hardening Index score and actionable recommendations.

rkhunter (Rootkit Detection)

sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --check

10. Configure Two-Factor Authentication (2FA)

Add TOTP-based 2FA (e.g. Google Authenticator) as an additional SSH authentication layer:

sudo apt install libpam-google-authenticator -y
google-authenticator

Edit PAM config:

sudo nano /etc/pam.d/sshd
# Add:
auth required pam_google_authenticator.so

Edit sshd_config:

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

sudo systemctl restart sshd

11. Log Monitoring

# View recent failed logins
sudo lastb | head -20

# View successful logins
sudo last | head -20

# Watch auth log in real time
sudo tail -f /var/log/auth.log | grep -i "failed\|invalid\|error"

# Install logwatch for daily email summaries
sudo apt install logwatch -y
sudo logwatch --output mail --mailto [email protected] --detail high

Security Hardening Checklist

Frequently Asked Questions

Conclusion

VPS security hardening is not complicated and takes less than an hour, but it makes an enormous difference between a compromised server and a secure one. Start with the highest priority items: update the system, set up SSH key authentication, and enable the firewall. Then progressively add additional security layers.

If you are looking for a reliable VPS provider, AsiaGB.com offers servers in Thailand with DirectAdmin and Thai-language support, while Bangmod Cloud is another popular Thailand-based option at competitive pricing.