Quick answer: Right after your Cloud2Y VPS is deployed: update all packages, create a sudo user, switch SSH to key authentication, disable root and password logins, enable a firewall, install Fail2ban, turn on automatic security updates and set up backups. This checklist takes about 30 minutes and blocks the most common attacks.
Overview
New servers are scanned by bots within minutes of going online, so the first hour matters. Cloud2Y services are unmanaged — the operating system and everything on it are your responsibility. This condensed checklist covers the essentials; the step-by-step version with full commands is in how to secure your VPS after deployment.
Before you start
- Root access to your VPS (how to connect via SSH).
- An SSH key pair on your computer (how to set up SSH keys).
- The KVM Console in the Client Area as a safety net if you lock yourself out.
Step-by-step guide
- Update everything:
apt update && apt upgrade -y # Ubuntu/Debian dnf upgrade -y # AlmaLinux/Rocky - Create a sudo user and stop working as root day-to-day.
- Install your public key and confirm key login works.
- Harden SSH: disable root login (guide) and password authentication (secure SSH access).
- Enable a firewall allowing only the ports you use (firewall guide).
- Install Fail2ban to ban brute-force sources automatically (guide).
- Enable automatic security updates (keep packages updated).
- Set up backups to a remote location — a compromised or broken server without backups is a total loss.
Common issues
- Locked out after hardening SSH? Use the KVM Console on your service page to log in locally and fix the config.
- Firewall enabled before allowing SSH? Always add the SSH rule first, then enable the firewall.
- Skipping backups: security reduces risk; only backups remove the cost of failure.
When to contact support
If you lose all access (SSH and KVM Console), or you suspect the server was compromised before you finished hardening, open a support ticket with your service details.
Frequently asked questions
How fast do new servers get attacked?
Automated bots scan the whole IPv4 space continuously, so login attempts usually start within minutes of a new server going online. Hardening should be the first thing you do after deployment.
Is my Cloud2Y VPS secured out of the box?
Cloud2Y secures the network and hardware, but VPS plans are unmanaged: the operating system, its updates, firewall and applications are set up and maintained by you as the administrator.
What is the single most important step?
Switching SSH to key-based authentication and disabling password logins removes the attack vector behind most server compromises, and it takes about five minutes to complete.
Related articles
- How to secure your VPS after deployment
- How to secure SSH access
- How to install Fail2ban
- How to keep Linux packages updated
Need a hand? Contact Cloud2Y support →
