A freshly deployed VPS is typically scanned by automated botnets within minutes of going online. Use this comprehensive security hardening guide to lock down your host server infrastructure.
1. OpenSSH Server Hardening
Important: Verify that your custom SSH Key authentication is fully functional before implementing these adjustments to prevent administrative lockout.
Edit your configuration configuration file at /etc/ssh/sshd_config and modify or append the following values:
PermitRootLogin no
Port 2222
Apply the changes immediately by restarting the secure shell system daemon:
Crucial Verification Step: Keep your current terminal session open, launch a secondary terminal window independently, and test connecting via your custom port (2222) prior to terminating your primary connection.
2. Host-Level Firewall Framework
Block all unmapped network ingestion paths, explicitly whitelisting only essential service channels.
ufw default allow outgoing
ufw allow 2222/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
3. Brute-Force Mitigation via Fail2Ban
Fail2Ban systematically intercepts and isolates adversarial IP space targeting service connections with repeated unvetted authentication loops.
Install the core engine files and create your persistent operational configuration overlay profile:
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Access /etc/fail2ban/jail.local via your terminal editor and adjust the [sshd] context box mapping parameters explicitly to your custom listener port configuration:
enabled = true
port = 2222
maxretry = 3
bantime = 3600
Reinitialize the operational state of the monitoring service module and extract real-time filter metrics:
fail2ban-client status sshd
Supplementary Hardening Guidelines
- Automated Patch Deployment: Initialize
unattended-upgrades(Ubuntu architectures) or deploydnf-automaticservices (CentOS distributions) to handle security maintenance tasks seamlessly behind the scenes. - Operational Audit Logging: Configure the kernel-level
auditdtracking infrastructure toolset to record system execution footprints and track privileged task invocations. - Log Inspection Audits: Perform structured health inspections on system records located within
/var/log/auth.log(Ubuntu/Debian) or/var/log/secure(CentOS/AlmaLinux) paths to cross-examine suspect operational anomalies. - Access Boundary Whitelisting: Consider enforcing strict network isolation controls by introducing a security VPN endpoint gateway or hardcoding specific static administrative source IP restrictions directly within your firewall access layers.
