- Golden rule: Immediately disable root remote login and password authentication in OpenSSH (/etc/ssh/sshd_config.d/).
- Recommended cryptography: Use Ed25519 public keys (ssh-keygen -t ed25519) instead of legacy short RSA keys.
- Default firewall posture: Set default deny incoming policy in UFW and only expose essential ports (SSH, 80, 443).
- Active intrusion deterrence: Deploy Fail2ban with dedicated jails for SSH and Nginx with exponential ban durations.
A newly deployed server faces thousands of automated probes per minute. Applying baseline hardening reduces your attack surface significantly. For network layer defense, consult our guide on DDoS Attack Mitigation on Linux.
1. Security Stages and Mitigated Vulnerabilities
The following table summarizes the critical stages of Linux VPS fortifying and their security impact:
Table 1: Linux VPS Hardening Stages and Mitigated Attack Surface
| Hardening Stage | Tool / Configuration | Primary Action | Mitigated Vulnerability |
|---|---|---|---|
| Identity Management | sudo / /etc/sudoers | Create non-root administrative user with granular privileges | Accidental privilege misuse or unlogged root commands |
| OpenSSH Service | /etc/ssh/sshd_config.d/hardening.conf | PasswordAuthentication no & PermitRootLogin no | Brute-force credential stuffing and dictionary attacks |
| Edge Packet Filtering | UFW / iptables | Default Deny incoming policy | Port scanning and accidental exposure of internal services |
| Intrusion Response | Fail2ban (/etc/fail2ban/jail.local) | Automated IP ban after 3 failed handshakes | Continuous brute-force botnets and socket exhaustion |
2. Non-Root User Setup and Sudo Delegation
Begin by disabling interactive root login and operating through an unprivileged user with granted administrative delegation:
# Create administration user
adduser sysadmin_jorge
# Add to sudoers group (Debian/Ubuntu) or wheel (RHEL/Rocky)
usermod -aG sudo sysadmin_jorge
# Copy authorized SSH keys
mkdir -p /home/sysadmin_jorge/.ssh
chmod 700 /home/sysadmin_jorge/.ssh
cp /root/.ssh/authorized_keys /home/sysadmin_jorge/.ssh/
chown -R sysadmin_jorge:sysadmin_jorge /home/sysadmin_jorge/.ssh
chmod 600 /home/sysadmin_jorge/.ssh/authorized_keys3. OpenSSH Daemon Hardening (/etc/ssh/sshd_config)
Configure OpenSSH to enforce Ed25519 key authentication and reject password-based attempts:
# Change default port (optional to reduce automated scan noise)
Port 2222
# Prohibit root login
PermitRootLogin no
# Enforce public key auth only
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
# Cap authentication attempts
MaxAuthTries 3
MaxSessions 2
# Disable unused forwarding
X11Forwarding no
AllowTcpForwarding no4. Firewall Hardening via UFW
A default-deny posture guarantees that auxiliary services running locally remain isolated from internet traffic:
# 1. Set default policy: deny incoming, allow outgoing
ufw default deny incoming
ufw default allow outgoing
# 2. Allow SSH port prior to enabling firewall
ufw allow 2222/tcp comment 'Custom SSH Port'
# 3. Allow standard web traffic
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
# 4. Activate firewall
ufw enable5. Next Step in the Security Cluster
Once the host OS is fortified, proceed to secure your ingress web server. Check our manual on Nginx Hardening and SSL/TLS Configuration to deploy strict TLS 1.3 encryption.