Secure a new VPS: an 8-step hardening checklist
A new VPS is reachable from the public internet within seconds of being provisioned, and automated bots start probing common ports almost immediately. VPS hardening is the work of closing those weak points before anyone exploits them. This checklist covers eight practical steps you can apply to a fresh Ubuntu or Debian server in under an hour. The examples assume you are connected as root over SSH to a CloudHosting VPS in our Riga data centre.
The 8-step checklist
1. Update the system first
Never harden on top of outdated packages. Refresh the index and install every pending patch, then reboot if the kernel changed:
apt update && apt upgrade -y reboot
2. Create a non-root sudo user
Working as root all day turns a single mistake into a disaster. Create a normal account and grant it sudo:
adduser deploy usermod -aG sudo deploy
Copy your SSH key to the new user and confirm you can log in and run sudo before you go further.
3. Lock down SSH
SSH is the most attacked service on any server. Switch to key-based login and disable the rest. Edit /etc/ssh/sshd_config:
PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes
Reload with systemctl restart ssh. Keep your current session open and test a new one before you disconnect.
4. Enable a firewall
Allow only the ports you actually use. With UFW:
ufw default deny incoming ufw default allow outgoing ufw allow OpenSSH ufw allow 80,443/tcp ufw enable
5. Add brute-force protection
Fail2ban watches your logs and bans IP addresses after repeated failed logins:
apt install fail2ban -y systemctl enable --now fail2ban
The default jail already protects SSH. Check active bans with fail2ban-client status sshd.
6. Turn on automatic security updates
Most breaches use known bugs that already have fixes. Let the server patch itself:
apt install unattended-upgrades -y dpkg-reconfigure -plow unattended-upgrades
7. Shrink the attack surface
Every running service is a potential entry point. List what is listening and disable anything you do not need:
ss -tulpn systemctl disable --now <service>
Remove unused packages, sample databases and default web apps. A smaller footprint is easier to defend and to audit.
8. Encrypt, back up and monitor
Put valid TLS certificates in front of every public service so traffic is encrypted end to end, and never rely on self-signed certificates in production. Schedule off-server backups, and forward logs to a place you actually check. Even a daily snapshot turns a compromise into a quick restore instead of a total loss.
Keep it maintained
Hardening is not a one-time task. Review users, open ports and package versions on a regular schedule, and align your controls with NIS2 and GDPR expectations if you handle EU data. CloudHosting customers get 24/7 human support and EU data sovereignty from our own Riga facility, so you are never troubleshooting a locked-out server alone.
Takeaway: update, remove root and password logins, close every port you do not need, and automate patching plus backups. Those four habits stop the large majority of automated attacks against a new VPS.