Automated scanners find new servers within minutes of them going online and start trying passwords. Before you install your application, spend half an hour on the basics.
1. Log in and update
Connect over SSH with the details you received, then install all available updates (apt update and apt upgrade on Ubuntu or Debian, dnf upgrade on AlmaLinux or Rocky). Reboot if the kernel was updated.
2. Create your own user
Create a regular user with sudo rights and use it for daily work, instead of logging in as root.
3. Switch to SSH keys
Add your public key to the new user, confirm you can log in with it, then disable password logins and direct root login in the SSH configuration. Keep your current session open until you have tested a new one. Our article on SSH keys explains how.
4. Turn on a firewall
Allow only what you need: SSH, and HTTP and HTTPS if you run a website. On Ubuntu, ufw makes this simple. Remember to allow SSH before enabling the firewall.
5. Protect against password guessing
Install a tool such as fail2ban, which blocks addresses after repeated failed logins.
6. Set the time zone and automatic security updates
Correct time matters for logs and certificates. Unattended security updates keep the system patched between your own maintenance windows.
7. Plan backups now
Turn on snapshots or backups before you put real data on the server. An untested backup is not a backup, so try a restore early.
Prefer someone else to do it?
IDX cloud VPS plans give you full root access to do all of this yourself. If you would rather focus on your application, our managed servers service handles hardening, updates, monitoring and backups for you. See also our Linux server hardening checklist.
IDX on digital infrastructure
Back to blog →