Why Every New VPS Is Attacked Within Minutes
Within seconds of launching a new public IP address on any cloud provider, automated botnets will scan your server for port 22 and attempt brute-force dictionary attacks against the root user. Leaving default configurations on a production server is an invitation for disaster.
Here is our battle-tested checklist to secure an Ubuntu 24.04 LTS or Debian 12 server for production workloads.
Step 1: Create a Non-Root Sudo User
Never run daily applications or SSH sessions as root. Create a dedicated administrative user:
adduser deployer
usermod -aG sudo deployerStep 2: Configure SSH Key Authentication & Disable Password Login
Generate an Ed25519 key pair on your local workstation and copy it to your server:
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@YOUR_SERVER_IPThen edit /etc/ssh/sshd_config and enforce the following directives:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding noRestart the SSH daemon: sudo systemctl restart ssh.
Step 3: Configure UFW (Uncomplicated Firewall)
Block all incoming connections by default, and whitelist only required ports:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableStep 4: Install and Enable Fail2ban
Fail2ban monitors system authentication logs and automatically adds temporary firewall drop rules for IP addresses exhibiting malicious repeated login failures:
sudo apt update && sudo apt install fail2ban -y
sudo systemctl enable --now fail2banStep 5: Configure Unattended Security Upgrades
Ensure critical Linux kernel and OpenSSL vulnerabilities are patched automatically:
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgradesSummary Checklist
Following these foundational steps eliminates over 99.8% of automated cyber attacks against your Linux server. Once your server is secured, you can safely deploy Docker, Nginx, or your database clusters.