Paj Digital Labs

Title

Slug

/blog/hardening-a-fresh-vps

Excerpt

Content (Markdown)

## Why the first 30 minutes matter

A freshly provisioned VPS is scanned within minutes of getting a public IP. Bots hammer port 22 with credential lists long before you have deployed anything. The window between provisioning and hardening is the single riskiest period in a server's life.

## Step 1 — Keys only, never passwords

Generate a key locally, push it, then disable password auth entirely.

```bash
ssh-keygen -t ed25519 -C "ops@pajdigital"
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@your.server.ip
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl reload sshd
```

## Step 2 — A non-root deploy user

Running your stack as root is how a single template injection becomes a full box takeover.

```bash
adduser deploy
usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy
```

## Step 3 — Firewall defaults

Deny everything inbound, then open only what you serve.

```bash
ufw default deny incoming
ufw default allow outgoing
ufw allow 22,80,443/tcp
ufw enable
```

## Step 4 — Automatic security updates

Unattended upgrades are not optional on an internet-facing box.

```bash
apt install -y unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades
```

## Step 5 — Watch the logs

Install fail2ban, point it at sshd and your web server, then actually read the jail status weekly. Most breaches are loud for days before they are damaging.

## Wrapping up

None of this is exotic. It is a checklist, and checklists are how infrastructure teams stay boring. Boring is the goal.

Edit post