You just bought a VPS from Azion Cloud and logged in for the first time. The server works, you can install software, everything seems fine. But right now, your VPS is vulnerable. Bots are already scanning it, trying default passwords, and looking for open ports.

Within minutes of a new VPS going online, automated bots will start brute-forcing SSH. If you don't secure your server, it's not a question of if you'll be compromised — it's when.

Here are 10 essential security steps you should complete before doing anything else on your VPS.

1. Update Everything First

The very first command you run should update all packages:

sudo apt update && sudo apt upgrade -y

This patches known vulnerabilities in the OS and installed software. Make this a regular habit — or better, set up automatic updates (Step 9).

2. Create a Non-Root User

Never work as root. Create a regular user with sudo privileges:

adduser abhijot
usermod -aG sudo abhijot

From now on, log in as this user and use sudo when you need elevated privileges. This limits the damage if your account is compromised and creates an audit trail of administrative actions.

3. Set Up SSH Key Authentication

Passwords can be brute-forced. SSH keys cannot (practically). On your local machine, generate a key pair:

# On your local machine (not the VPS)
ssh-keygen -t ed25519 -C "[email protected]"

Copy the public key to your VPS:

ssh-copy-id abhijot@your-server-ip

Now you can log in without a password. Test it before proceeding to Step 4.

4. Disable Root Login & Password Authentication

Only do this after confirming SSH key login works! Edit the SSH config:

sudo nano /etc/ssh/sshd_config

Find and change these lines:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

sudo systemctl restart sshd

This single step blocks 99% of brute-force attacks because bots can't try passwords anymore.

5. Change the SSH Port

Most bots scan port 22 (the default SSH port). Changing it reduces noise in your logs:

# In /etc/ssh/sshd_config
Port 2222  # Choose any port between 1024-65535

Remember to update your firewall rules (Step 6) before restarting SSH, or you'll lock yourself out!

sudo ufw allow 2222/tcp
sudo systemctl restart sshd

6. Set Up a Firewall (UFW)

UFW (Uncomplicated Firewall) is the easiest way to manage firewall rules on Ubuntu/Debian:

# Allow SSH (use your custom port if changed)
sudo ufw allow 2222/tcp

# Allow common services
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS

# For Minecraft server
sudo ufw allow 25565/tcp

# For FiveM server
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp

# Enable the firewall
sudo ufw enable
sudo ufw status

Only open ports you actually need. Every open port is a potential attack surface.

7. Install Fail2Ban

Fail2Ban monitors log files and automatically bans IPs that show malicious behavior (failed logins, exploit attempts):

sudo apt install fail2ban -y
sudo systemctl enable fail2ban

Create a local config file:

sudo nano /etc/fail2ban/jail.local

Add these settings:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log

This bans any IP that fails 3 login attempts within 10 minutes, for 1 hour. Restart Fail2Ban:

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

8. Disable Unused Services

Check what's running and disable anything you don't need:

sudo systemctl list-units --type=service --state=running

Common services to disable on a fresh VPS:

sudo systemctl disable --now cups       # Printing (not needed on servers)
sudo systemctl disable --now avahi-daemon # mDNS (not needed on servers)
sudo systemctl disable --now bluetooth   # Bluetooth (not needed)

9. Enable Automatic Security Updates

Install unattended-upgrades to automatically install security patches:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

This ensures your server gets critical security patches even if you forget to update manually.

10. Set Up Regular Backups

Security isn't just about preventing attacks — it's about recovering when something goes wrong. Set up a simple backup script:

#!/bin/bash
# backup.sh - Run daily via cron
DATE=$(date +%Y-%m-%d)
BACKUP_DIR="/backups"
mkdir -p $BACKUP_DIR

# Backup important directories
tar -czf $BACKUP_DIR/home-$DATE.tar.gz /home/
tar -czf $BACKUP_DIR/etc-$DATE.tar.gz /etc/

# Keep only last 7 days
find $BACKUP_DIR -name "*.tar.gz" -mtime +7 -delete

Add it to cron:

sudo crontab -e
# Add this line:
0 3 * * * /root/backup.sh

Bonus: Security Checklist

What's Next?

With these 10 steps complete, your VPS is significantly more secure than 90% of servers on the internet. From here, you can:

Need a VPS to practice on? Azion Cloud's VPS plans start from ₹199/mo with NVMe SSDs, DDoS protection, and instant setup. All plans include full root access so you can follow every step in this guide.