Linux KVM VPS HostingServer Hardening

VPS Security, UFW Firewall & Fail2ban

Harden your Ubuntu / Debian VPS against automated port scanners and brute-force attacks by implementing cryptographic SSH keys and strict packet filtering.

1. Creating a Dedicated Non-Root Sudo User

Running daily commands as root is hazardous. Create a dedicated user:

Terminal Command

# Add a new user (replace 'adminuser' with your chosen name)
adduser adminuser

# Add the user to the sudo group
usermod -aG sudo adminuser

2. Setting Up SSH Key Pair Authentication

On your local computer (PowerShell / macOS Terminal), generate an Ed25519 key pair:

Local Computer Terminal

# Run on your LOCAL PC:
ssh-keygen -t ed25519 -C "adminuser@oryncloud-vps"

# Copy the public key to your VPS:
ssh-copy-id adminuser@YOUR_SERVER_IP

3. Configuring UFW Firewall Rules

Allow Port 22 Before Enabling UFW

Always allow SSH (ufw allow 22/tcp) before enabling the firewall, otherwise you will sever your active connection!

UFW Firewall Commands

# Set default policies
ufw default deny incoming
ufw default allow outgoing

# Allow SSH
ufw allow 22/tcp

# Allow HTTP and HTTPS web traffic (if hosting websites)
ufw allow 80/tcp
ufw allow 443/tcp

# Enable firewall
ufw enable

# Check status
ufw status verbose

4. Installing Fail2ban Brute-Force Shield

Fail2ban monitors SSH auth logs and temporarily bans IPs that fail login 5 times:

Fail2ban Setup

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

5. Disabling Root Password Logins

Once your SSH key works, edit /etc/ssh/sshd_config:

/etc/ssh/sshd_config

PermitRootLogin prohibit-password
PasswordAuthentication no

Restart the SSH daemon: systemctl restart sshd.

Was this documentation page helpful?

Initial VPS Setup & SSH Access Guide

Docker & Containerized App Setup