The first hour with a new VPS: a security checklist

Why the first hour matters

A fresh IP starts attracting automated scans within minutes of coming online. The steps below shut out the overwhelming majority of them.

1. Change the root password

The very first thing after you log in:

passwd

2. Create a non-root user

adduser deploy
usermod -aG sudo deploy

3. Switch to SSH keys

Copy your public key across, then close off password logins:

ssh-copy-id deploy@YOUR_SERVER_IP

Then in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no

4. Turn on the firewall

ufw allow OpenSSH
ufw enable

5. Apply updates

apt update && apt upgrade -y

6. Install fail2ban

apt install fail2ban -y
systemctl enable --now fail2ban

Six steps, and your server drops off the radar of nearly every automated attack.