05VPS & dedicated servers

Secure your VPS – firewall, Fail2ban, SSH and updates

How to secure your Nexthosting VPS: firewall with ufw or firewalld, Fail2ban, turning off password login, automatic updates and backups.

In short

Secure your VPS in five steps: turn on a firewall, install Fail2ban, allow SSH with keys only, automate updates and set up backups. It takes half an hour and keeps out most automated attacks.

A VPS is a server whose security you are responsible for, see VPS overview. Nexthosting protects the network against DDoS attacks. You secure the system itself, its users and the programs on it yourself.

The prerequisite is that you can already log in via SSH, have a user with sudo and have set up an SSH key: VPS: first steps with SSH. You run the commands below with sudo or as root.

Order of hardening

Firewallonly necessary ports open
Fail2banblocks attackers
Harden SSHkeys only
Automate updates
Backups

1. Set up a firewall

A firewall only lets through the connections you allow. After installation, only SSH and, if you run a web server, HTTP and HTTPS should be open.

Debian and Ubuntu (ufw)
AlmaLinux and Rocky Linux (firewalld)

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# only for a web server:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
# only for a web server:
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Later, open exactly the port each service needs, and no more. A game server, for example, needs the port of its game, such as ufw allow 25565/tcp for Minecraft.

In addition to the firewall in the system, your VPS has a firewall in the customer account: Netzwerk (network) tab, Firewall section. There you turn it on, add rules and use the quick buttons “SSH erlauben (TCP 22)” (allow SSH) and “RDP erlauben (TCP 3389)” (allow RDP).

2. Install Fail2ban

Fail2ban reads the server’s logs and blocks IP addresses that enter a wrong password too often.

Debian and Ubuntu
AlmaLinux and Rocky Linux

sudo apt install -y fail2ban

sudo dnf install -y epel-release
sudo dnf install -y fail2ban

Create your own configuration so that updates do not overwrite it:

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true

Save with Ctrl+O, Enter, exit with Ctrl+X and start the service:

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

The last command shows how many addresses are currently blocked. After a few hours on the internet, that is usually already a handful.

3. Allow SSH with keys only

Once the SSH key works, you turn off password login and block direct root login with a password.

Keep a second terminal open in which you are already logged in. If something goes wrong, you can get back in through it.
Edit the configuration. On current systems you create a file of your own:
Terminal window
```
sudo nano /etc/ssh/sshd_config.d/10-haerten.conf
```
```
PasswordAuthentication no
PermitRootLogin prohibit-password
```
prohibit-password only allows the root user to log in with a key. If you only want to work with your own user, use PermitRootLogin no instead.
Check the syntax and reload.
Terminal window
```
sudo sshd -t
sudo systemctl reload sshd
```
On Debian and Ubuntu the service is called ssh instead of sshd: sudo systemctl reload ssh.
Test in a new terminal that logging in with the key still works. Only then close the old window.

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Confirm the question with Yes. Security updates are then installed automatically.

sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

The timer downloads updates daily and installs them. The settings are in /etc/dnf/automatic.conf.

Even with automation, you should log in now and then and check whether a restart is needed, for example after a kernel update.

5. Set up backups

Backups are included in the VPS price, you do not have to book anything extra. But you have to create them yourself. Otherwise a mistake during an update or a deleted folder can cost you data permanently.

Use backups in the customer account: In the Backups tab of your VPS you create, restore or delete backups. Under Geplante Aufgaben (scheduled tasks) a backup can be repeated regularly, from daily to every 3 months.
Back up yourself: Regularly copy important data somewhere else, for example with rsync to another computer or with a tool such as restic.
Test restoring: A backup is only a backup once you have restored it at least once.

rsync -avz --delete /var/www/ anna@backup-rechner:/sicherung/www/

A backup on the same server does not protect you if that server fails. Keep at least one copy elsewhere.

More rules

Install only software you need, and remove what you no longer use.
Use a separate strong password per service, or better, keys.
Read the messages from Fail2ban and journalctl now and then to spot anything unusual.
Use sudo ss -tlnp to check which programs listen on which ports.

Frequently asked questions

Is the DDoS protection from Nexthosting enough?

The DDoS protection shields the network from overload by attacks. It does not replace a firewall in the system and does not stop break-ins through weak passwords or outdated programs. Both remain your job.

What if my VPS was hacked?

Ideally shut the system down, contact support and secure your data. Reinstall the system rather than cleaning it, and change all passwords that were stored on the server.

That is more secure if your user has sudo and you have tested the key. But keep a way into the system: the console in the VNC tab in the customer account works without SSH.