How to harden a Linux server

Quick answer: The core checklist: keep packages updated, log in with SSH keys instead of passwords, disable root password login, run a firewall that allows only needed ports, install Fail2ban, and remove services you don't use. An hour of hardening prevents almost all opportunistic attacks.

Overview

Every public IP is scanned constantly by bots trying default passwords and known exploits. On an unmanaged Cloud2Y server, OS security is your responsibility — and the essentials below stop the overwhelming majority of automated attacks.

Before you start

• Root/sudo SSH access (how to connect).
• The KVM Console on your service page as a safety net in case you lock yourself out.

Step-by-step guide

1. Update everything and enable automatic security updates (guide).
2. Create a sudo user and stop working as root day-to-day:

   adduser admin && usermod -aG sudo admin

3. Switch to SSH keys (guide), then disable password auth in /etc/ssh/sshd_config:

   PasswordAuthentication no
   PermitRootLogin prohibit-password

   Reload: sudo systemctl reload ssh. Test a new key login in a second terminal before closing your session.
4. Enable a firewall — allow only SSH and your public services (UFW guide):

   sudo ufw allow OpenSSH && sudo ufw allow 80,443/tcp && sudo ufw enable

5. Install Fail2ban to ban brute-force sources automatically (guide).
6. Minimize the attack surface: list listeners with sudo ss -tlnp and remove/stop anything you don't recognize or need; bind internal services (databases) to 127.0.0.1.
7. Watch the logs (guide) — a quick weekly scan of auth logs catches trouble early.

Common issues

• Locked out after SSH changes: use the KVM Console on your service page to log in locally and revert sshd_config.
• Firewall enabled before allowing SSH: always ufw allow OpenSSH before ufw enable.
• Database exposed to the internet: bind to localhost or firewall to a specific source IP — public DB ports are a top compromise vector.

When to contact support

If you are locked out and the KVM Console doesn't help, or you suspect the server is already compromised, open a ticket immediately with what you observed.

Frequently asked questions

What are the most important hardening steps?

Keep packages updated, use SSH keys with password login disabled, run a firewall that allows only needed ports, install Fail2ban and remove unused services.

What if I lock myself out while changing SSH settings?

Open the KVM Console on your Cloud2Y service page — it gives screen-level access without SSH, so you can log in locally and revert the sshd_config change.

Is a firewall really necessary on a VPS?

Yes. Every public IP is scanned constantly. A default-deny firewall that allows only SSH and your public services removes most of the attack surface at once.

Related articles

• How to secure your VPS after deployment
• How to keep Linux packages updated
• How to install Fail2ban
• How to check system logs

Need a hand? Contact Cloud2Y support →