Copied to clipboard<\/span><\/p>\napt update && apt upgrade -y && apt autoremove -y<\/code><\/pre>\n<\/div>\nOn AlmaLinux\/Rocky Linux:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\ndnf update -y && dnf autoremove -y<\/code><\/pre>\n<\/div>\nReboot after a kernel update:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nreboot<\/code><\/pre>\n<\/div>\nStep 2: Create a Non-Root User with Sudo Access<\/h3>\n Never run day-to-day operations as root. If an attacker gets command execution under your session, root means game over. A sudo user limits the blast radius.<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nadduser deploy\nusermod -aG sudo deploy<\/code><\/pre>\n<\/div>\nOn AlmaLinux\/Rocky, the sudo group is called wheel<\/code>:<\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nusermod -aG wheel deploy<\/code><\/pre>\n<\/div>\nSwitch to the new user and verify sudo works before you touch SSH config:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsu - deploy\nsudo whoami<\/code><\/pre>\n<\/div>\nIt should return root<\/code>. If it doesn’t, stop and fix group membership before proceeding.<\/p>\nStep 3: Lock Down SSH<\/h3>\n SSH is the most attacked service on any public server. The default configuration is far too permissive.<\/p>\n
Open the SSH config file:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n<\/div>\nMake the following changes:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\n# Change the default port (22 is scanned constantly)\nPort 2222\n\n# Disable root login entirely\nPermitRootLogin no\n\n# Disable password authentication \u2014 use keys only\nPasswordAuthentication no\n\n# Limit to specific user(s)\nAllowUsers deploy\n\n# Disable unused authentication methods\nX11Forwarding no\nPermitEmptyPasswords no\n\n# Reduce login timeout\nLoginGraceTime 30<\/code><\/pre>\n<\/div>\n\u26a0 Warning:<\/strong> Do NOT restart SSH yet. Set up key-based authentication first (Step 4) and confirm it works in a second terminal window before closing your current session. Locking yourself out of a remote server is a real problem, and recovery usually means booting into rescue mode through your hosting control panel.<\/p>\nStep 4: Set Up SSH Key Authentication<\/h3>\n On your local machine (not the server), generate a key pair if you don’t have one:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nssh-keygen -t ed25519 -C "your_email@example.com"<\/code><\/pre>\n<\/div>\nEd25519 is preferred over RSA in 2026. It’s faster and produces shorter keys that are harder to brute-force.<\/p>\n
Copy the public key to the server:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nssh-copy-id -i ~\/.ssh\/id_ed25519.pub deploy@your-server-ip<\/code><\/pre>\n<\/div>\nIf ssh-copy-id<\/code> isn’t available (Windows, for example), manually append the contents of id_ed25519.pub<\/code> to ~\/.ssh\/authorized_keys<\/code> on the server.<\/p>\nNow restart SSH:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo systemctl restart sshd<\/code><\/pre>\n<\/div>\nIn a new terminal window, test login before closing the original:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nssh -p 2222 deploy@your-server-ip<\/code><\/pre>\n<\/div>\n\ud83d\udcdd Note:<\/strong> If your server is managed through cPanel\/WHM, check whether WHM enforces its own SSH settings under Security Center > SSH Password Authorization Tweak<\/em> \u2014 your manual edits can get overwritten during updates.<\/p>\nStep 5: Configure a Firewall<\/h3>\n UFW (Uncomplicated Firewall) ships with Ubuntu and works well for most VPS setups. On AlmaLinux\/Rocky, firewalld<\/code> is the default \u2014 I’ll cover both.<\/p>\nUFW (Ubuntu\/Debian):<\/strong><\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw allow 2222\/tcp # Your new SSH port\nsudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp\nsudo ufw enable\nsudo ufw status verbose<\/code><\/pre>\n<\/div>\nfirewalld (AlmaLinux\/Rocky):<\/strong><\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo firewall-cmd --permanent --add-port=2222\/tcp\nsudo firewall-cmd --permanent --add-service=http\nsudo firewall-cmd --permanent --add-service=https\nsudo firewall-cmd --permanent --remove-service=ssh # Removes default port 22\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-all<\/code><\/pre>\n<\/div>\n\u26a0 Warning:<\/strong> If you’re on a Host & Tech dedicated server with a hardware firewall in front, make sure the rule changes are consistent at both layers. Blocking port 80 in UFW but leaving it open at the hardware level (or vice versa) creates confusing behaviour that’s hard to debug.<\/p>\nStep 6: Install and Configure Fail2Ban<\/h3>\n Fail2Ban monitors log files and temporarily bans IPs that show signs of brute-force attacks. It’s not a silver bullet, but it cuts noise significantly.<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo apt install fail2ban -y # Ubuntu\/Debian\n# or\nsudo dnf install fail2ban -y # AlmaLinux\/Rocky<\/code><\/pre>\n<\/div>\nCreate a local config file so your changes survive package updates:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local\nsudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n<\/div>\nFind the [sshd]<\/code> block and update it:<\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\n[sshd]\nenabled = true\nport = 2222\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 5\nbantime = 3600\nfindtime = 600<\/code><\/pre>\n<\/div>\nStart and enable the service:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo systemctl enable fail2ban\nsudo systemctl start fail2ban\nsudo fail2ban-client status sshd<\/code><\/pre>\n<\/div>\n\ud83d\udcdd Note:<\/strong> On AlmaLinux\/Rocky, the auth log path is \/var\/log\/secure<\/code>, not \/var\/log\/auth.log<\/code>. Getting this wrong means Fail2Ban runs silently without actually watching SSH.<\/p>\nStep 7: Enable Automatic Security Updates<\/h3>\n Missing a security patch because you forgot to log in for two weeks is an embarrassingly common way servers get compromised. Unattended upgrades cover security patches automatically without touching major version updates.<\/p>\n
On Ubuntu\/Debian:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo apt install unattended-upgrades -y\nsudo dpkg-reconfigure --priority=low unattended-upgrades<\/code><\/pre>\n<\/div>\nOn AlmaLinux\/Rocky, use dnf-automatic<\/code>:<\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo dnf install dnf-automatic -y\nsudo nano \/etc\/dnf\/automatic.conf<\/code><\/pre>\n<\/div>\nSet apply_updates = yes<\/code> and upgrade_type = security<\/code>, then enable the timer:<\/p>\n<\/path><\/path><\/svg><\/path><\/svg><\/button>Copied to clipboard<\/span><\/p>\nsudo systemctl enable --now dnf-automatic.timer<\/code><\/pre>\n<\/div>\nStep 8: Disable Unused Services<\/h3>\n Every running service is a potential attack surface. Check what’s listening:<\/p>\n
<\/path><\/path><\/svg><\/path><\/svg><\/button>