[SECURITY] Hardening Your Linux VPS: Fail2Ban, SSH Keys, and UFW

[JackaL]

[SECURITY] Hardening Your Linux VPS: Fail2Ban, SSH Keys, and UFW

The moment you purchase a DigitalOcean droplet or a Hetzner VPS and connect it to the internet, botnets begin scanning it for vulnerabilities and brute-forcing your root password. Here is the mandatory 10-minute checklist to lock down your server.

---

Step 1: Disable Password Login & Use SSH Keys
Passwords can be brute-forced. Cryptographic keys cannot. Generate an SSH key on your local machine and add it to your server.

# On your server, edit the SSH config
nano /etc/ssh/sshd_config

# Change these lines to NO:
PermitRootLogin no
PasswordAuthentication no

# Restart SSH service
systemctl restart sshd

Step 2: Configure UFW (Uncomplicated Firewall)
Block all incoming traffic by default, and only open the ports you strictly need (SSH, HTTP, HTTPS).

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp  # SSH
ufw allow 80/tcp  # HTTP
ufw allow 443/tcp # HTTPS
ufw enable

Step 3: Install Fail2Ban
Fail2Ban monitors your server logs. If an IP address fails to login 5 times in a row, Fail2Ban automatically blocks that IP at the firewall level.

apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban