How to secure your VPS after deployment

Quick answer: Right after deployment: update all packages, switch SSH to key authentication, create a non-root sudo user, enable a firewall allowing only the ports you use, and install Fail2ban. These five steps stop the vast majority of automated attacks.

Overview

A fresh public server is scanned by bots within minutes — password guessing on SSH starts almost immediately. Cloud2Y VPS are unmanaged: the OS security baseline is your responsibility, and this checklist is the baseline. It takes about 20 minutes.

Before you start

• Root SSH access to the new VPS.
• Know which services must stay reachable (e.g. 80/443 for web).

Step-by-step guide

1. Update everything:

   apt update && apt upgrade -y     # Ubuntu / Debian
   dnf upgrade -y                    # AlmaLinux / Rocky

2. Create an admin user — see creating a new user.
3. Install your SSH key and disable password login — see SSH keys:

   nano /etc/ssh/sshd_config
   # PasswordAuthentication no
   # PermitRootLogin prohibit-password
   systemctl restart sshd

4. Enable the firewall (Ubuntu/Debian example with UFW; details in the UFW guide):

   apt install -y ufw
   ufw allow OpenSSH
   ufw allow 80,443/tcp
   ufw enable

5. Install Fail2ban to ban brute-force sources automatically — see the Fail2ban guide.
6. Enable automatic security updates (Ubuntu/Debian):

   apt install -y unattended-upgrades
   dpkg-reconfigure -plow unattended-upgrades

Common issues

• Locked out by the firewall? Always allow SSH before ufw enable. If it happens, use the KVM Console on the service page.
• Disabled passwords before testing keys? Re-enable via the console — test key login first next time.
• Running everything as root "just for now"? That's how servers stay insecure — do step 2 early.

When to contact support

If you suspect the server was already compromised (strange processes, unknown SSH keys, traffic spikes), open a support ticket — and consider a clean OS reinstall.

Frequently asked questions

Is a new VPS really attacked that fast?

Yes — bots scan the whole IPv4 space continuously; SSH password guessing typically starts within minutes of a server going online.

Is Cloud2Y responsible for securing my VPS?

The infrastructure — yes; the OS and applications on an unmanaged VPS — you. This checklist is the customer-side baseline.

What is the single most important step?

SSH keys with password login disabled. It eliminates the most common attack — password brute force.

Related articles

• How to set up SSH keys
• How to configure UFW firewall
• How to install Fail2ban
• How to create a new user on Linux VPS

Need a hand? Contact Cloud2Y support →