Securing your first Linux VPS: 10 steps

The moment your VPS boots, automated bots start probing it for weak passwords and open ports. The good news: a handful of basic steps blocks the overwhelming majority of attacks. Work through these ten in order on any new Ubuntu or Debian server.

1. Update everything first

Patched software is your first line of defence:

sudo apt update && sudo apt upgrade -y

2. Create a non-root user

Doing everything as root is risky. Make a normal user with sudo rights and use that day to day:

sudo adduser alex
sudo usermod -aG sudo alex

3. Set up SSH key authentication

Keys are far stronger than passwords. From your own computer:

ssh-copy-id alex@your-server-ip

Confirm you can log in with the key before moving on.

4. Disable password and root SSH login

Edit /etc/ssh/sshd_config and set:

PermitRootLogin no
PasswordAuthentication no

Then reload SSH with sudo systemctl restart ssh. Now only key-holders get in.

5. Turn on a firewall

Allow only what you need. With UFW:

sudo ufw allow OpenSSH
sudo ufw enable

Open extra ports (like 80 and 443 for a website) explicitly as you add services.

6. Install fail2ban

fail2ban watches your logs and bans IPs that hammer SSH with failed logins:

sudo apt install fail2ban -y

It works out of the box with sensible defaults.

7. Enable automatic security updates

So you're patched even when you're not paying attention:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

8. Change or protect exposed services

Anything listening on the public internet — databases especially — should be bound to localhost or firewalled off. Never expose a database to the world with a default password.

9. Keep backups

Security includes recovery. Snapshot your server or back up critical data regularly, and actually test that a restore works.

10. Check what's listening

Periodically audit open ports so nothing unexpected is exposed:

sudo ss -tulpn

If you see a service you don't recognise or need, shut it down.

The bottom line

None of these steps is advanced, and together they put you ahead of the vast majority of targets. A non-root user, SSH keys, a firewall and automatic updates alone stop nearly all opportunistic attacks — do those four today and add the rest as you go.