How to Secure a Linux VPS

In the digital age, securing your Linux Virtual Private Server (VPS) is paramount for safeguarding your data and infrastructure. This comprehensive guide explores methods to protect your Linux VPS against cyber threats.

Keep Your System Updated

One of the most important aspects of securing your Linux VPS is making sure that your system is up to date. Outdated software can contain vulnerabilities that malicious actors can exploit. Here's how to do it:

Use Package Manager

Most Linux distributions provide a package manager. For instance, if you are using a Debian-based system, you can run the following commands to update and upgrade packages:

COPY
sudo apt update
sudo apt upgrade

If you're on a CentOS system, use yum:

COPY
sudo yum update

Set Up Automatic Updates

Set Up Automatic Updates with unattended-upgrades on Debian-based Systems:

On Debian-based systems like Ubuntu, you can use the unattended-upgrades package to automate the update process.

COPY
sudo apt install unattended-upgrades

COPY
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

COPY
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
    "${distro_id}:${distro_codename}-proposed";
    "${distro_id}:${distro_codename}-backports";
};

COPY
sudo dpkg-reconfigure -plow unattended-upgrades

This command will prompt you to confirm the changes. Select "Yes" to enable automatic updates.

Set Up Automatic Updates with yum-cron on CentOS:

On CentOS, you can use yum-cron for automatic updates:

COPY
sudo yum install yum-cron

COPY
sudo systemctl enable yum-cron
sudo systemctl start yum-cron

Use Strong Passwords and SSH Keys for Secure Authentication

Securing your Linux VPS involves using strong authentication methods. Whether you are connecting from a Linux or Windows client, here's how to use strong passwords and SSH keys effectively:

Using Strong Passwords

When creating user accounts on your VPS, make sure that passwords are complex, combining uppercase and lowercase letters, numbers, and special characters. Avoid easily guessable passwords.

Using SSH Key Authentication

For Linux Client:

COPY
ssh-keygen -t rsa -b 2048

The public key, by default, will be stored in ~/.ssh/id_rsa.pub.

COPY
ssh-copy-id user@your_server_ip

COPY
PasswordAuthentication no

For Windows Client:

COPY
ssh-keygen

COPY
type $env:USERPROFILE\.ssh\id_rsa.pub | ssh root@{IP-ADDRESS-OR-FQDN} "cat >> .ssh/authorized_keys"

COPY
PasswordAuthentication no

Implement a Firewall

Securing your Linux VPS involves setting up a firewall to control incoming and outgoing traffic. Here's how to implement a firewall to enhance security:

Use ufw (Uncomplicated Firewall) on Debian/Ubuntu or firewalld on CentOS:

For ufw on Debian/Ubuntu:

COPY
sudo apt install ufw

For firewalld on CentOS:

COPY
sudo yum install firewalld

For ufw on Debian/Ubuntu:

COPY
sudo ufw allow OpenSSH

For firewalld on CentOS:

COPY
sudo firewall-cmd --permanent --add-service=ssh

For ufw on Debian/Ubuntu:

COPY
sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing

For firewalld on CentOS:

COPY
sudo systemctl start firewalld
sudo systemctl enable firewalld

For ufw on Debian/Ubuntu:

COPY
sudo ufw reload

For firewalld on CentOS:

COPY
sudo systemctl reload firewalld

Disable Root Login

Securing your Linux VPS involves restricting root access. Here's how to disable root login for enhanced security:

COPY
adduser newuser
usermod -aG sudo newuser

COPY
mkdir -p /home/newuser/.ssh
touch /home/newuser/.ssh/authorized_keys
chmod 600 /home/newuser/.ssh/authorized_keys
chown -R newuser:newuser /home/newuser/.ssh

Open the SSH server configuration file on your VPS. This file is usually located at /etc/ssh/sshd_config:

COPY
sudo nano /etc/ssh/sshd_config

Locate the line that reads PermitRootLogin and set it to no:

COPY
PermitRootLogin no

Save the file and exit the text editor.

After making this change, you should restart the SSH service for the new settings to take effect:

On Debian/Ubuntu:

COPY
sudo systemctl restart ssh

On CentOS:

COPY
sudo systemctl restart sshd

Harden SSH Configuration

Securing your Linux VPS involves further hardening the SSH configuration for added security and ensuring that UFW rules are up to date. Here's how to harden your SSH settings and update the UFW rules:

If you're using UFW (Uncomplicated Firewall), first allow the new SSH port before making changes to the default port:

COPY
# Allow the new SSH port (e.g., 2222)
sudo ufw allow 2222/tcp

After changing the SSH port, you should remove the old OpenSSH service (default port 22) from the UFW rules to ensure that only the new SSH port is allowed:

COPY
# Remove the old OpenSSH service (default port 22)
sudo ufw delete allow OpenSSH

By default, SSH uses port 22. Changing the default port can add an extra layer of security by making it harder for automated bots to find your SSH server.

Open the SSH server configuration file:

COPY
sudo nano /etc/ssh/sshd_config

Find the line that reads Port 22 and change the port number to a different, unused port, for example, 2222:

COPY
Port 2222

You can set a time limit for key reauthentication to further secure your SSH session. This means that if you leave your SSH session unattended, it will automatically expire after a certain time.

Add or modify the following lines in the SSH server configuration file, then save it:

COPY
ClientAliveInterval 300
ClientAliveCountMax 2

COPY
sudo ufw reload
sudo systemctl restart ssh

COPY
ssh -p <new_port> user@your_server_ip

Implement Fail2Ban

Securing your Linux VPS involves protecting it from brute-force login attempts and other types of malicious activity. Fail2Ban is a useful tool for this purpose. Here's how to implement Fail2Ban:

Start by updating your package list to ensure you have the latest available packages:

For Debian-based systems (e.g., Ubuntu):

COPY
sudo apt update

For CentOS:

COPY
sudo yum update

Install Fail2Ban:

For Debian-based systems:

COPY
sudo apt install fail2ban

For CentOS:

COPY
sudo yum install fail2ban

Fail2Ban's main configuration file is located at /etc/fail2ban/jail.conf. You can create an override file at /etc/fail2ban/jail.local to customize settings without modifying the default configuration. Open this file:

COPY
sudo nano /etc/fail2ban/jail.local

Add the following configuration to ban IP addresses for 10 minutes (600 seconds) after six failed login attempts. Adjust the parameters as needed:

COPY
[sshd]
enabled = true
maxretry = 6
findtime = 600
bantime = 600

Save the file and exit the text editor.

Start Fail2Ban and enable it to start at boot:

COPY
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

You can check the status of Fail2Ban to ensure it's working as expected:

COPY
sudo fail2ban-client status

You should see that it's monitoring the SSH service.

The 6 essential methods discussed here provide a robust defense against potential vulnerabilities. By keeping your system updated, employing strong authentication, configuring firewalls, hardening SSH, and implementing Fail2Ban, you fortify your VPS and maintain peace of mind in the ever-connected world. If you have any questions, don’t hesitate to contact our support team by submitting a ticket.