Ten minutes to a hardened VPS

A fresh server is at its most vulnerable in its first hour: default config, password auth on, nothing patched since the image was built. The good news is that basic hardening is ten minutes of copy-paste, and it defeats essentially all of the automated attacks that will ever hit you. Here is the minimum viable checklist, in order.

1. Keys in, passwords out

Put your public key on the server (our templates accept it at deploy time via cloud-init), confirm you can log in with it, then disable password authentication:

sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo systemctl restart sshd

This one change eliminates the entire category of brute-force attacks. Keep one terminal logged in while you test the second - lockouts are self-inflicted downtime.

2. Patch, and keep patching without you

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Unattended security updates are the single highest-value cron job on any server. The theoretical risk of an update breaking something is real but small; the risk of an unpatched service is a statistic.

3. fail2ban for the leftovers

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

With key-only SSH, fail2ban is mostly log hygiene - it bans the IPs that hammer your port so your logs stay readable. The default SSH jail is fine as shipped.

4. Close the doors

Use the panel firewall: allow 22 (ideally from your IP only), allow what your server actually serves, done. Everything else - databases, admin UIs, metrics - stays on localhost behind an SSH tunnel.

5. The habits that keep it secure

Run services as non-root users. Take a backup before every upgrade. Check last -a and ss -tlnp once in a while - knowing what normal looks like is how you spot abnormal. None of this is exotic; it is the difference between being a statistic and being boring, and boring is the goal.