Configure Your First VPS — Beginner Guidance A virtual private server, also known as a VPS, acts as an isolated, virtual environment on a physical server, which is owned and operated by a cloud or web hosting provider. VPS hosting uses virtualization technology to split a single physical machine into multiple private server environments that share the resources, (<a href="https://cloud.google.com/learn/what-is-a-virtual-private-server" target="_blank">cloud.google.com</a>). Today I want to share something important with you. Step by step how to configure your first VPS to make sure it is safe and secure. But, in this article I focus on configuring the Ubuntu VPS. So, if you want to learn the other OS tutorial this is not for you. Change SSH Port SSH stands for (Secure Shell) in simple term, this is the protocol you need it the most because you need to use this protocol to establish a connection between your laptop and your VPS. By default SSH port was 22 . You may wondering, “Why I need to change the SSH Port ?” As I mentioned earlier, SSH is a crucial protocol that you need to protect the most. Without SSH you can’t ping google.com from your VPS cause you can’t even connect with your VPS bruh 😅. “What if I don’t change the SSH port? ”Everyone would know your VPS SSH port cause it’s the default one, and as it should be, you open the security gap and attract attackers to create a party on your VPS. Nah, just kidding 🫣. You can open your VPS terminal and change the SSH port by typing this sudo nano /etc/ssh/sshd_configPress enter or click to view image in full size Remove # before Port 22 and change the port as your preferences. Remember use the unused port to avoid port conflict Don’t forget to deny the root login on your SSH by adding this linePermitRootLogin no at the bottom of the config Then, restart the SSH service by typing this command systemctl restart sshd So the next time you want to connect your VPS by using SSH, you need to specify the port like this and you only can connect to your SSH by using non-root user. ssh username@your_vps_ip -p new_ssh_port Create a New User Make sure you create a new user. Don’t use Root!. “Why do I need to create a new user ?” If you are using root, your action will be not recorded, and so if you working with several slave (I mean developer 👽) on your team it will hard to track who is perform the action if something unexpected happen. You can create a new user by typing this sudo adduser your_new_user Then, the linux will ask the password and other information then, just enter the password and hit enter. To switch user from root to your_new_user you can use this command su - your_new_user Now you have already logged in by using your new user. But, as you notice, there is another problem. If you running some command such as sudo apt update Then, it will show an error like this Press enter or click to view image in full size It because your_new_user is not in the sudoers groups. Then you just need to add your_new_user to the sudoers groups by typing this command below sudo usermod -aG sudo your_new_user-a : appends the user to the group.-G : specifies the group. Then, you can use groups command, and you’ll see sudo user.Then you can PermitRootLogin no on etc/ssh/sshd_config to make sure only non-root user that allowed to connect the SSH. Setup UFW UFW stand for uncomplicated firewall which is a command-line tool that manages firewalls on Ubuntu and Debian systems. You can type this command to install ufw sudo apt update -y && sudo apt install ufw -y Then you can set which port that allowed to access from public (exposed) by typing this sudo ufw allow your_port then enable ufw sudo ufw enable This will secure your VPS. Automatically Block the Suspicious IP If you own a VPS, you may notice several hacking attempts in your server logs. Malicious actors often try to brute-force SSH logins or exploit vulnerabilities to gain access. One effective way to defend your server is by using <a href="https://github.com/fail2ban/fail2ban" target="_blank">Fail2Ban</a>, a security tool that automatically blocks suspicious IPs based on predefined rules. Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time. You can install fail2ban by using this command sudo apt update && sudo apt install fail2ban -y After installation completed, you can enable and start the fail2ban service using these commands sudo systemctl enable fail2ban #enable servicesudo systemctl start fail2ban #start service Then you need to add config for the fail2ban service. First of all you’ll need to copy the default config using this command sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local Edit the file using a text editor sudo nano /etc/fail2ban/jail.local find the [sshd] section and add this script [sshd]enabled = trueport = sshfilter = sshdlogpath = /var/log/auth.logmaxretry = 5bantime = 3600 # Ban for 1 hourfindtime = 600 # Within 10 minutes Then, save it and restart the service sudo systemctl restart fail2ban To check the banned IPs you can type sudo fail2ban-client status sshd Or you may want to unban an IP sudo fail2ban-client set sshd unbanip <IP_ADDRESS> Finally, you are ready to start deploying your project! The steps above provide a solid foundation for securing your VPS during the initial setup. If you have any other suggestions or want to install additional monitoring tools for your VPS, feel free to share them in the comments below. Don’t forget to give me a clap, and happy coding! 🚀
