Enhance security for your VPS. | Servers Guru

To enhance the security of your Virtual Private Server (VPS), you must implement a multi-layered defense strategy. Below is the comprehensive checklist of actionable steps and the exact terminal commands to secure your server:

Phase 1: Identity & Access Management (IAM)

The standard root account with password authentication is the primary target for automated brute-force attacks. Securing entry points is step zero.

1. Create a Non-Root User with Sudo Privileges

Operating as root increases the risk of catastrophic system errors or privilege escalation exploits. Create a dedicated user account:

Create user: (Replace adminuser with your desired username)

adduser adminuser

Grant sudo access:

For Debian/Ubuntu:
```
usermod -aG sudo adminuser 
```
For RHEL/CentOS:
```
usermod -aG wheel adminuser
```

2. Enforce SSH Key Authentication

Disable password logins entirely in favor of cryptographic key pairs (Ed25519 or RSA 4096-bit).

Generate a key pair on your local machine:

Bash

ssh-keygen -t ed25519 -C "[email protected]"

Copy the public key to your VPS:

Bash
```
ssh-copy-id adminuser@your_vps_ip
```

3. Harden the SSH Configuration

Edit /etc/ssh/sshd_config (or a drop-in file in /etc/ssh/sshd_config.d/) to enforce strict authentication parameters:

# /etc/ssh/sshd_config
Port 2222                 # Change default port to reduce automated bot noise
PermitRootLogin no        # Disable direct root access
PasswordAuthentication no # Force SSH key usage
MaxAuthTries 3            # Limit login attempts per connection
X11Forwarding no          # Disable graphical forwarding

Apply the changes:

Bash

sudo systemctl restart sshd

Phase 2: Network Perimeter Defense

Once entry point policies are configured, strictly control network traffic entering and exiting your server.

1. Configure a Strict Firewall

Implement an explicit default-deny inbound policy. Allow traffic only on explicitly required ports.

Install Firewall:

Bash
- For Ubuntu/Debian:
```
sudo apt install ufw
```
- For RHEL/CentOS:
```
sudo dnf install firewalld -y
```

Ubuntu / Debian (UFW) config:

Bash

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp  # Custom SSH port
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

RHEL / CentOS / AlmaLinux (Firewalld) config:

Bash

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

2. Implement Automated Intrusion Prevention (Fail2ban)

Fail2ban scans system logs (like /var/log/auth.log) for repeated failed login attempts and dynamically injects temporary firewall rules to ban offenders.

Install Fail2ban:

For Ubuntu/Debian:
```
sudo apt install fail2ban -y
```
For RHEL/CentOS:
```
sudo dnf install fail2ban -y
```

Create a custom jail file at /etc/fail2ban/jail.local:

Ini, TOML
[sshd]
enabled = true
port = 2222
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
findtime = 10m
bantime = 1h

Start and enable the service:

sudo systemctl enable --now fail2ban

Phase 3: Operating System & Software Patching

Vulnerabilities in outdated system packages are frequently targeted via public exploit scripts.

1. Enable Automated Security Updates

Ensure operating system packages receive security patches automatically without manual intervention.

Ubuntu/Debian:

Bash

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

RHEL/CentOS:

Bash

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic.timer

2. Disable Unnecessary Services

Every running service adds to your attack surface. Inspect active network listeners and stop unused daemons:

Bash

# View active TCP/UDP listening ports
sudo ss -tulpn

Disable any unnecessary services:

Bash

sudo systemctl stop <service_name>
sudo systemctl disable <service_name>

Phase 4: Application Isolation & Monitoring

Security doesn't stop at the operating system layer; applications running on the VPS must also be sandboxed.

Containerization: Run public-facing applications (e.g., web servers, application runtimes) inside Docker or Podman containers to limit access to the host filesystem.
Reverse Proxying & WAF: Place web applications behind reverse proxies like Nginx or cloud security providers (e.g., Cloudflare) to mask your origin server's IP address and mitigate DDoS attacks.
Log Auditing: Regularly monitor access logs or centralized logging agents to detect anomalous traffic patterns early:

Bash
```
# Check failed login attempts
sudo journalctl -u ssh -g "Failed"
```