How to secure your VPS

A server on the internet is scanned by bots from its first minute. A few steps after the installation make breaking in much harder.

1. SSH keys instead of a password

1. On your computer, create a key: ssh-keygen -t ed25519.
2. Add the public key (.pub) in Server configuration → SSH access.
3. Once you have checked that you can log in with the key, turn off password logins: set PasswordAuthentication no in /etc/ssh/sshd_config and restart the SSH service.

2. Updates

Update the system regularly, e.g. on Debian and Ubuntu:

apt update && apt upgrade -y

You can also turn on automatic security updates (unattended-upgrades).

3. Firewall

In the panel's Firewall tab, open only the ports you need (e.g. 22 for SSH, 80 and 443 for a website). Block the rest. The panel's rules work in front of the server, so you cannot lock yourself out for good: you can always change them.

4. Protection against password guessing

fail2ban blocks addresses that give a wrong password many times:

apt install -y fail2ban

5. Backups

Make a backup in Backups before bigger changes. Keep important data outside the server too.

6. Your account

Turn on two-factor authentication for your EpicHost account (Your profile). Give team members only the permissions they need.