Before you start

A new VPS is reachable from the whole internet within minutes, and automated scanners start trying SSH passwords almost immediately. The steps below take about fifteen minutes and close the most common ways in. Commands are shown for Debian and Ubuntu, with the AlmaLinux and Rocky Linux version where it differs.

Keep your current SSH session open while you change the SSH settings, and test every change from a second window. If you ever lock yourself out, use the VPS console in the MAXKO panel.

1. Update the system

# Debian / Ubuntu
apt update && apt upgrade -y

# AlmaLinux / Rocky Linux
dnf upgrade -y

Reboot if the kernel was updated.

2. Create a user for daily work

Working as root all the time makes every mistake more dangerous. Create your own user with sudo rights (replace maxko with your name):

# Debian / Ubuntu
adduser maxko
usermod -aG sudo maxko

# AlmaLinux / Rocky Linux
adduser maxko
passwd maxko
usermod -aG wheel maxko

3. Log in with an SSH key

Keys are far stronger than passwords. On your own computer (Linux, macOS or Windows PowerShell) create a key pair:

ssh-keygen -t ed25519 -C "you@example.com"

Copy the public key to the server:

ssh-copy-id maxko@203.0.113.10

On Windows without ssh-copy-id, add the content of %USERPROFILE%\.ssh\id_ed25519.pub as a new line to ~/.ssh/authorized_keys of the new user on the server, then run chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.

Open a new window and check that ssh maxko@203.0.113.10 logs you in without asking for the server password.

4. Turn off password and root login

Only do this after the key login works. Edit the SSH server settings:

sudo nano /etc/ssh/sshd_config

Set these lines (remove the # in front of them if needed):

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no

Files in /etc/ssh/sshd_config.d/ can override these values, so check them with grep -r PasswordAuthentication /etc/ssh/sshd_config.d/. Then test the configuration and restart SSH:

sudo sshd -t
# Debian / Ubuntu
sudo systemctl restart ssh
# AlmaLinux / Rocky Linux
sudo systemctl restart sshd

Test the login from a second window before you close the first one.

5. Enable a firewall

Allow only the services you really use. On Debian and Ubuntu, UFW is the simplest choice:

sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status

On AlmaLinux and Rocky Linux, use firewalld:

sudo dnf install firewalld -y
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https
sudo firewall-cmd --reload

Leave out 80 and 443 (http and https) if the server does not run a website.

6. Block repeated login attempts with Fail2ban

Fail2ban watches the SSH log and temporarily blocks addresses that keep failing to log in.

# Debian / Ubuntu
sudo apt install fail2ban -y

# AlmaLinux / Rocky Linux (from EPEL)
sudo dnf install epel-release -y
sudo dnf install fail2ban -y

Create /etc/fail2ban/jail.local with:

[sshd]
enabled = true
maxretry = 5
bantime = 1h

On Debian 12 add the line backend = systemd to the same section, because SSH logs go to the system journal there. Then start it and check the status:

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

7. Install security updates automatically

# Debian / Ubuntu
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

# AlmaLinux / Rocky Linux
sudo dnf install dnf-automatic -y

On AlmaLinux and Rocky Linux, set apply_updates = yes in /etc/dnf/automatic.conf and enable the timer with sudo systemctl enable --now dnf-automatic.timer.

8. Keep backups

Security is also about recovering quickly. Keep regular backups of your data and configuration in a second location, not only on the same server. Our guide How to Plan Backups for Your Hosting Account explains how to set up a simple plan.

Next steps

Just ordered your server? Read First Steps After Ordering a VPS Server. If SSH does not start after a fresh Debian 12 install, see How to Fix SSH After a Debian 12 Install.