How to Secure a Fresh Ubuntu/Debian VPS in 3 Minutes (Essential Checklist)

Deploying a new VPS is exciting, but it’s also the most vulnerable moment for your server. Automated bots scan IP ranges 24/7, looking for unsecured SSH ports and default credentials.

If you just spun up a fresh Ubuntu or Debian server for your homelab or side project, here is the absolute minimum you need to do before putting any real data on it.

1. Update and Upgrade

Always start by patching known vulnerabilities in the default system packages.

apt-get update && apt-get upgrade -y

2. Configure a Basic Firewall (UFW)

Never leave all ports exposed. The Uncomplicated Firewall (UFW) is built into Ubuntu and very easy to set up. We will deny everything by default and only allow SSH, HTTP, and HTTPS.

ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow http
ufw allow https
ufw --force enable

3. Stop Brute-Force Attacks with Fail2Ban

Even with a firewall, bots will try to guess your SSH password thousands of times per minute. Fail2Ban monitors your logs and temporarily blocks IPs that fail to authenticate.

apt-get install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

4. Lock Down SSH

The root user is the primary target for hackers. You must disable direct root login. (Make sure you have created a standard user with sudo privileges first!)

Open your SSH config file:
nano /etc/ssh/sshd_config

Find the line PermitRootLogin and change it to no. Then, restart the service:
systemctl restart sshd

The Automated Way

While doing this manually is good practice, it becomes incredibly tedious if you manage multiple servers or frequently spin up new instances.

To save myself time, I packaged this entire hardening checklist into a single, automated Bash script. It handles the updates, configures the firewall, installs Fail2Ban, and hardens SSH in about 15 seconds.

If you want to skip the manual typing and use the automated script for your own servers, you can grab the ready-to-use package here:
Download the Premium Linux Hardening Script

Stay safe, and happy building!