Linux VPS: First Hardening Steps for India-Based Deployments
A fresh VPS gets scanned by bots within minutes of going online. Doing these five things in your first hour of root access closes off the vast majority of opportunistic attacks.
Switch to SSH key authentication, disable password login
Generate an SSH keypair locally, copy the public key to ~/.ssh/authorized_keys, then set PasswordAuthentication no in /etc/ssh/sshd_config. This alone stops nearly all brute-force login attempts.
Create a non-root sudo user
Stop logging in as root day-to-day. Create a user, add it to the sudo group, and reserve root access for when it's truly needed.
Set up a firewall
With UFW: allow only SSH, HTTP and HTTPS (ufw allow 22,80,443), then ufw enable. Everything else gets blocked by default.
Install fail2ban
Automatically bans IPs after repeated failed login attempts — a simple, effective layer against brute-force scanning.
Enable automatic security updates
Install unattended-upgrades on Ubuntu/Debian so critical security patches apply without you having to remember.
Quick Summary
- 1 SSH keys only, no password login
- 2 Non-root sudo user, firewall, fail2ban
- 3 Automatic security updates so patches don't depend on memory