A fresh Linux VPS is wide open by default. Here's a basic hardening checklist worth running through before putting anything important on it.
Create a non-root user with sudo privileges, and disable direct root login over SSH.
Switch to SSH key authentication and disable password login entirely.
Change the default SSH port (optional, but cuts down on automated scan noise significantly).
Set up a firewall (ufw/firewalld) and only open the ports you actually need.
Enable automatic security updates for the OS at minimum.
Install fail2ban to automatically block IPs after repeated failed login attempts.
Disable unused services running by default that you don't need.
What's the first thing you do on a brand-new server before anything else?
Last edited: