SSH: the front door to lock
90% of VPS compromises start with SSH. The service is exposed by nature, and brute-force bots scan it continuously. Here's the minimum hardening every server should have — the one our images apply by default.
Keys, not passwords
ssh-keygen -t ed25519 on your workstation, public key in authorized_keys, then in sshd_config:
PasswordAuthentication no
PermitRootLogin prohibit-password
KbdInteractiveAuthentication noWith these three lines, brute-forcing becomes useless: there's no password left to guess.
Non-standard port: yes, but
Moving port 22 to 2222 divides log noise by a hundred. It's not security — any nmap finds the port — but it saves Fail2ban work and keeps your logs readable.
Fail2ban and allowlists
If your IPs are static, a UFW allowlist on the SSH port is the ultimate protection: the service becomes invisible to the rest of the world. Otherwise, Fail2ban with bantime = 1h and maxretry = 3 neutralizes bots.
The classic trap
Always test the new configuration in a second SSH session before closing the first. An sshd -t validates the syntax. And keep our VNC rescue console in mind: even locked out, you always get back in through the panel.