The Ultimate Guide to Securing Your VPS Hosting in 2026

Securing a newly deployed Linux VPS is the single most important step before deploying production applications, Discord bots, or game servers. With automated scanners probing port 22 around the clock, implementing basic server hardening prevents 99.9% of brute-force and automated intrusion attempts.

1. Disable Root Password Login

Logging in directly as root over SSH leaves your system vulnerable to username-guessing attacks. Instead, create a dedicated user with sudo privileges and disable direct root SSH access.

bashCopy
# Create a new non-root user
adduser deployer
usermod -aG sudo deployer

Edit /etc/ssh/sshd_config:

bashCopy
PermitRootLogin no
PasswordAuthentication no

Restart the SSH service:

bashCopy
sudo systemctl restart sshd

2. Use SSH Key Authentication Only

SSH keys use 4096-bit RSA or Ed25519 cryptography, making them immune to dictionary attacks.

Generate a modern Ed25519 keypair on your local machine:

bashCopy
ssh-keygen -t ed25519 -C "admin@heavencloud"

Copy your public key to your server:

bashCopy
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@YOUR_SERVER_IP

3. Change the Default SSH Port

While security through obscurity is not sufficient on its own, moving your SSH port from standard port 22 to a high-range port (e.g. 2222 or 28472) eliminates over 95% of automated bot scans in your auth logs.

Edit /etc/ssh/sshd_config:

bashCopy
Port 2222

Make sure to allow the new port in your firewall before restarting SSH!

4. Configure UFW (Uncomplicated Firewall)

A properly configured firewall only allows traffic on explicitly permitted ports, dropping all other inbound packets.

bashCopy
# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow your custom SSH port and web ports
sudo ufw allow 2222/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable
sudo ufw status verbose

5. Install and Configure Fail2Ban

Fail2Ban monitors system authentication logs and automatically bans IP addresses that show malicious intent, such as repeated password failures.

bashCopy
sudo apt install -y fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Configure your jail rules in /etc/fail2ban/jail.local:

iniCopy
[sshd]
enabled = true
port = 2222
maxretry = 3
findtime = 600
bantime = 3600

Start and enable Fail2Ban:

bashCopy
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

6. Enable Automatic Security Updates

Keep your server patched against newly discovered CVEs without manual intervention:

bashCopy
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

7. Monitor Resource Usage & DDoS Activity

Anomalous CPU spikes or bandwidth saturations are often the first sign of an attempted intrusion or bot attack.

HeavenCloud includes enterprise HVNC multi-terabit DDoS mitigation and real-time VirtFusion monitoring out of the box on all India VPS and US VPS tiers.