10단계로 완성하는 VPS 보안 설정

Why these 10 steps

A VPS exposed on the Internet receives its first SSH brute-force attempts within minutes of going online. This checklist is the one our engineers apply to every machine — apply it before installing anything else.

1. Update immediately

apt update && apt upgrade -y — most exploits target unpatched packages.

2. Create a non-root user

adduser deploy && usermod -aG sudo deploy

3. Install your SSH keys

Copy your public key into /home/deploy/.ssh/authorized_keys (Ed25519 recommended: ssh-keygen -t ed25519).

4. Harden sshd

In /etc/ssh/sshd_config: PasswordAuthentication no, PermitRootLogin no, and a non-standard port (e.g. 2222). Test in a second session before closing the first.

5. Enable UFW

ufw default deny incoming && ufw default allow outgoing
ufw allow 2222/tcp && ufw enable

6. Install Fail2ban

apt install fail2ban — the default sshd jail is enough to start. Tune bantime to 1 h and maxretry to 3.

7. Enable automatic security updates

apt install unattended-upgrades then enable security updates in /etc/apt/apt.conf.d/50unattended-upgrades.

8. Disable unused services

systemctl list-unit-files --state=enabled — disable what you don't use (cups, avahi…).

9. Configure minimal swap if RAM < 4 GB

A 1 GB swap avoids brutal OOM kills: fallocate -l 1G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile.

10. Verify and monitor

ss -tlnp to list open ports; install Netdata for monitoring. A secured server is a monitored server.