In the digital age, securing your Linux Virtual Private Server (VPS)
is paramount for safeguarding your data and infrastructure. This
comprehensive guide explores methods to protect your Linux VPS against
cyber threats.

Keep Your System
Updated

One of the most important aspects of securing your Linux VPS is
making sure that your system is up to date. Outdated software can
contain vulnerabilities that malicious actors can exploit. Here’s how to
do it:

Use Package Manager

Most Linux distributions provide a package manager. For instance, if
you are using a Debian-based system, you can run the following commands
to update and upgrade packages:

sudo apt update
sudo apt upgrade

If you’re on a CentOS system, use yum:

sudo yum update

Set Up Automatic
Updates

Set Up Automatic Updates with unattended-upgrades on
Debian-based Systems:

On Debian-based systems like Ubuntu, you can use the
unattended-upgrades package to automate the update process.

Install unattended-upgrades:

sudo apt install unattended-upgrades

Configure the automatic update settings. Edit the configuration
file:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Enable automatic updates for security-related packages:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
    "${distro_id}:${distro_codename}-proposed";
    "${distro_id}:${distro_codename}-backports";
};

Enable and start the unattended-upgrades service:

sudo dpkg-reconfigure -plow unattended-upgrades

This command will prompt you to confirm the changes. Select “Yes” to
enable automatic updates.

Set Up Automatic Updates with yum-cron on
CentOS:

On CentOS, you can use yum-cron for automatic updates:

Install yum-cron:

sudo yum install yum-cron

Start and enable the yum-cron service:

sudo systemctl enable yum-cron
sudo systemctl start yum-cron

Use
Strong Passwords and SSH Keys for Secure Authentication

Securing your Linux VPS involves using strong authentication methods.
Whether you are connecting from a Linux or Windows client, here’s how to
use strong passwords and SSH keys effectively:

Using Strong
Passwords

When creating user accounts on your VPS, make sure that passwords are
complex, combining uppercase and lowercase letters, numbers, and special
characters. Avoid easily guessable passwords.

Using SSH Key
Authentication

For Linux Client:

To generate an SSH key pair on your Linux client, use the ssh-keygen
command:

ssh-keygen -t rsa -b 2048

The public key, by default, will be stored in ~/.ssh/id_rsa.pub.

Copy your public key to the VPS:

ssh-copy-id user@your_server_ip

Disable password-based SSH login on the VPS in the SSH server
configuration file (/etc/ssh/sshd_config):

PasswordAuthentication no

For Windows Client:

On Windows, use the PowerShell for similar functionality:

ssh-keygen

Copy your public key to the VPS using PowerShell. Replace
IP-ADDRESS-OR-FQDN with the remote server’s
address:

type $env:USERPROFILE\.ssh\id_rsa.pub | ssh root@{IP-ADDRESS-OR-FQDN} "cat >> .ssh/authorized_keys"

Disable password-based SSH login on the VPS in the SSH server
configuration file (/etc/ssh/sshd_config):

PasswordAuthentication no

Implement a Firewall

Securing your Linux VPS involves setting up a firewall to control
incoming and outgoing traffic. Here’s how to implement a firewall to
enhance security:

Use ufw (Uncomplicated Firewall) on Debian/Ubuntu or
firewalld on CentOS:

Install the firewall management tool if not already installed.

For ufw on Debian/Ubuntu:

sudo apt install ufw

For firewalld on CentOS:

sudo yum install firewalld

Add rules to allow SSH before enabling the firewall to prevent being
locked out:

For ufw on Debian/Ubuntu:

sudo ufw allow OpenSSH

For firewalld on CentOS:

sudo firewall-cmd --permanent --add-service=ssh

Enable the firewall and set default rules:

For ufw on Debian/Ubuntu:

sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing

For firewalld on CentOS:

sudo systemctl start firewalld
sudo systemctl enable firewalld

Reload the firewall for the changes to take effect.

For ufw on Debian/Ubuntu:

sudo ufw reload

For firewalld on CentOS:

sudo systemctl reload firewalld

Securing your Linux VPS involves restricting root access. Here’s how
to disable root login for enhanced security:

Create a New User: Log in to your VPS as the root user. Then create
a new user account with sudo privileges. Replace newuserwith your
desired username:

adduser newuser
usermod -aG sudo newuser

Create the .ssh Directory, authorized_keys and set permissions for
the New User:

mkdir -p /home/newuser/.ssh
touch /home/newuser/.ssh/authorized_keys
chmod 600 /home/newuser/.ssh/authorized_keys
chown -R newuser:newuser /home/newuser/.ssh

Make sure to generate and copy the public key to your
VPS.
Log in as the New User.
Disconnect from the VPS (if you’re connected as root) and log
back in using the new user account. This ensures you can perform
administrative tasks using sudo.
Edit SSH Configuration:

Open the SSH server configuration file on your VPS. This file is
usually located at /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

Locate the line that reads PermitRootLogin and set it to no:

PermitRootLogin no

Save the file and exit the text editor.

Restart SSH Service:

After making this change, you should restart the SSH service for the
new settings to take effect:

On Debian/Ubuntu:

sudo systemctl restart ssh

On CentOS:

sudo systemctl restart sshd

Harden SSH
Configuration

Securing your Linux VPS involves further hardening the SSH
configuration for added security and ensuring that UFW rules are up to
date. Here’s how to harden your SSH settings and update the UFW
rules:

Allow the New SSH Port in UFW:

If you’re using UFW (Uncomplicated Firewall), first allow the new SSH
port before making changes to the default port:

# Allow the new SSH port (e.g., 2222)
sudo ufw allow 2222/tcp

Remove OpenSSH from UFW Rules:

After changing the SSH port, you should remove the old OpenSSH
service (default port 22) from the UFW rules to ensure that only the new
SSH port is allowed:

# Remove the old OpenSSH service (default port 22)
sudo ufw delete allow OpenSSH

Change the SSH Port:

By default, SSH uses port 22. Changing the default port can add an
extra layer of security by making it harder for automated bots to find
your SSH server.

Open the SSH server configuration file:

sudo nano /etc/ssh/sshd_config

Find the line that reads Port 22 and change the port number to a
different, unused port, for example, 2222:

Port 2222

Enable Key Reauthentication:

You can set a time limit for key reauthentication to further secure
your SSH session. This means that if you leave your SSH session
unattended, it will automatically expire after a certain time.

Add or modify the following lines in the SSH server configuration
file, then save it:

ClientAliveInterval 300
ClientAliveCountMax 2

Reload UFW Rules and SSH Service:

sudo ufw reload
sudo systemctl restart ssh

Once you’ve made the necessary changes, you can establish a new SSH
connection using the following command:

ssh -p <new_port> user@your_server_ip

Implement Fail2Ban

Securing your Linux VPS involves protecting it from brute-force login
attempts and other types of malicious activity. Fail2Ban is a useful
tool for this purpose. Here’s how to implement Fail2Ban:

Install Fail2Ban:

Start by updating your package list to ensure you have the latest
available packages:

For Debian-based systems (e.g., Ubuntu):

sudo apt update

For CentOS:

sudo yum update

Install Fail2Ban:

For Debian-based systems:

sudo apt install fail2ban

For CentOS:

sudo yum install fail2ban

Configure Fail2Ban:

Fail2Ban’s main configuration file is located at
/etc/fail2ban/jail.conf. You can create an override
file at /etc/fail2ban/jail.local to customize settings
without modifying the default configuration. Open this file:

sudo nano /etc/fail2ban/jail.local

Add the following configuration to ban IP addresses for 10 minutes
(600 seconds) after six failed login attempts. Adjust the parameters as
needed:

[sshd]
enabled = true
maxretry = 6
findtime = 600
bantime = 600

Save the file and exit the text editor.

Start and Enable Fail2Ban:

Start Fail2Ban and enable it to start at boot:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Check Fail2Ban Status:

You can check the status of Fail2Ban to ensure it’s working as
expected:

sudo fail2ban-client status

You should see that it’s monitoring the SSH service.

The 6 essential methods discussed here provide a robust defense
against potential vulnerabilities. By keeping your system updated,
employing strong authentication, configuring firewalls, hardening SSH,
and implementing Fail2Ban, you fortify your VPS and maintain peace of
mind in the ever-connected world. If you have any questions, don’t
hesitate to contact our support team by submitting a
ticket.

Secure linux vps

Keep Your System Updated

Use Package Manager

Set Up Automatic Updates

Use Strong Passwords and SSH Keys for Secure Authentication

Using Strong Passwords

Using SSH Key Authentication

Implement a Firewall

Disable Root Login

Harden SSH Configuration

Implement Fail2Ban

Keep Your System
Updated

Set Up Automatic
Updates

Use
Strong Passwords and SSH Keys for Secure Authentication

Using Strong
Passwords

Using SSH Key
Authentication

Harden SSH
Configuration