Why these 10 steps
A VPS exposed on the Internet receives its first SSH brute-force attempts within minutes of going online. This checklist is the one our engineers apply to every machine — apply it before installing anything else.
1. Update immediately
apt update && apt upgrade -y — most exploits target unpatched packages.
2. Create a non-root user
adduser deploy && usermod -aG sudo deploy3. Install your SSH keys
Copy your public key into /home/deploy/.ssh/authorized_keys (Ed25519 recommended: ssh-keygen -t ed25519).
4. Harden sshd
In /etc/ssh/sshd_config: PasswordAuthentication no, PermitRootLogin no, and a non-standard port (e.g. 2222). Test in a second session before closing the first.
5. Enable UFW
ufw default deny incoming && ufw default allow outgoing
ufw allow 2222/tcp && ufw enable6. Install Fail2ban
apt install fail2ban — the default sshd jail is enough to start. Tune bantime to 1 h and maxretry to 3.
7. Enable automatic security updates
apt install unattended-upgrades then enable security updates in /etc/apt/apt.conf.d/50unattended-upgrades.
8. Disable unused services
systemctl list-unit-files --state=enabled — disable what you don't use (cups, avahi…).
9. Configure minimal swap if RAM < 4 GB
A 1 GB swap avoids brutal OOM kills: fallocate -l 1G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile.
10. Verify and monitor
ss -tlnp to list open ports; install Netdata for monitoring. A secured server is a monitored server.