How to Secure a Linux VPS: 10 Essential Steps

Harden your Linux VPS against attacks. SSH keys, firewall setup, fail2ban, automatic updates, and more security best practices.

2026-02-03 7 min read Amsterdam, Netherlands

Why Linux VPS Security Matters

A new Linux VPS connected to the internet is scanned by automated bots within minutes. These bots attempt to brute-force SSH passwords, exploit outdated software, and install malware. Ten essential steps will harden your VPS against the vast majority of automated attacks.

Step 1: Switch to SSH Key Authentication

# Generate key on your LOCAL machine
ssh-keygen -t ed25519 -C "my-vps"
ssh-copy-id root@YOUR_VPS_IP

# Disable password login on the SERVER
nano /etc/ssh/sshd_config
# Set: PasswordAuthentication no
systemctl restart sshd

Step 2: Change SSH Port

nano /etc/ssh/sshd_config
# Change: Port 22 to Port 2222
systemctl restart sshd

Step 3: Enable UFW Firewall

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp   # Your new SSH port
ufw allow 80/tcp     # HTTP
ufw allow 443/tcp    # HTTPS
ufw enable

Step 4: Install Fail2Ban

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

Fail2Ban automatically bans IP addresses that fail SSH login attempts repeatedly.

Step 5: Enable Automatic Security Updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

Step 6: Create Non-Root User

adduser deploy
usermod -aG sudo deploy
# Copy SSH key to new user
mkdir -p /home/deploy/.ssh
cp /root/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh

Security Checklist

SSH keys enabled, password login disabled
SSH port changed from default 22
UFW firewall active, only needed ports open
Fail2Ban installed and running
Automatic security updates enabled
Non-root user created for daily operations
Software kept updated: apt update && apt upgrade
Unnecessary services disabled

Deploy Secure Netherlands VPS

Full root access — implement your own security policy — from $3/month

Deploy Netherlands VPS Now

Frequently Asked Questions

Switching to SSH key authentication and disabling password login is the single most effective security measure. It eliminates brute-force attacks entirely since there is no password to guess.

Check for unusual processes with top or ps aux, review /var/log/auth.log for failed login attempts, check crontab -l for unknown cron jobs, and look for unknown user accounts in /etc/passwd.

Yes, after creating a non-root sudo user. Set PermitRootLogin no in /etc/ssh/sshd_config. This adds an extra layer of protection — attackers must guess both the username and authenticate successfully.

No. UFW (Uncomplicated Firewall) uses Linux iptables rules that are processed in the kernel at wire speed. There is no measurable performance impact on web traffic.

Run apt update && apt upgrade at minimum once per week. Enable unattended-upgrades for automatic security patches. Critical security updates should be applied within 24 hours of release.