VPS Server Hardening Guide

This guide covers essential steps to harden a Linux VPS against unauthorized access and attacks.

1. Update Your System

sudo apt update && sudo apt upgrade -y

2. Create a New User

sudo adduser myadmin
sudo usermod -aG sudo myadmin

3. Set Up SSH Key Authentication

ssh-keygen -t ed25519
ssh-copy-id myadmin@your_server_ip

4. Disable Root SSH Login and Password Authentication

Edit the SSH config file:

sudo nano /etc/ssh/sshd_config

Recommended settings:

PermitRootLogin no
PasswordAuthentication no

Restart SSH:

sudo systemctl restart ssh

For a complete guide on disabling password login and securing SSH, see: Disable SSH Password Login (Jink Host Guide)

5. Enable UFW Firewall

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

6. Configure sysctl for Network Hardening

sudo nano /etc/sysctl.d/99-sysctl.conf

net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.disable_ipv6 = 1

sudo sysctl -p /etc/sysctl.d/99-sysctl.conf

7. Install Fail2Ban

sudo apt install fail2ban -y

sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port = ssh
backend = systemd
bantime = 3600
findtime = 600
maxretry = 5

sudo systemctl restart fail2ban

8. Enable Automatic Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades

9. Secure File Permissions

chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

10. Audit Listening Services

sudo ss -tuln

Conclusion

Completing these steps provides a solid foundation for VPS security. For enhanced protection, regularly update your system and review logs. For additional SSH configuration, consult the linked guide above.