Skip to content
Register

Mini-guide: securing your VPS in 15 minutes

VPS Hosting Locked by pieter_rtm 5 replies 428 views
This thread is locked — new replies are not accepted. (Thread ran its course)
pieter_rtm

Member OP

#1

Securing your VPS in 15 minutes

To be honest, most breaches are lazy configs. As said, this is minimum viable security.

  • SSH: key auth only, port 2222 or random high, PermitRootLogin no
  • Firewall: ufw or nftables, default deny, open only what you need
  • Auto-updates: unattended-upgrades for security repo
  • Fail2ban: 3 strikes, 1 hour ban
  • AIDE or rkhunter: pick one, schedule weekly

Tested on Debian 12, 2 vCPU, 1GB RAM. Took 14 minutes. Copy-paste friendly.

Dry humor: your password "Correct horse battery staple" is not clever. I have seen it.

Containers before it was cool
Izmir

Member

#2

My friend very nice guide. I tink you forget one tought

Selinux or apparmor. My friend I see many server hacked because no MAC. Also you should mention logwatch my friend.

I run tis on my server and he very safe now. Tank you for guide!

techmei

Member

#3 
#!/bin/bash
# my version, add this
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

XD two server, not one!!! Will run this on all my server!!!

Also 

systemctl enable --now ssh

Not just enable, NOW!!! Very IMPORTANT!!!

kat_fold

Moderator

Moderator

#4

Hey folks, good discussion. Pinning this for visibility, but let's keep it focused on improvements.

@Izmir SELinux note is fair, though it adds time beyond 15 min. Maybe "phase 2" section?

@techmei appreciate the code blocks, but please use [code] for multi-line only. Single command clutters thread. Thanks for understanding.

~be kind or be gone~
AL

Member

1 #5

Actually, basically I do similar but with cloud-init so I never forget step (´・ω・｀)

Also I use ssh certificate instead of key, more easy actually for many server

But guide is 素晴らしい!!! I copy to my notes

PetraSuper

Member

network boot believer

#6

Hej, good guide. No mention of backup on server? No disaster recovery, only hardening.

I add to my copy: rclone sync to malý server offsite. No same datacenter.

Also into config, check 

/etc/ssh/moduli
for weak DH. I see this on old image.

boot anything, anywhere, anytime

Thread closed

Replies are closed on this thread. Thread ran its course.