Servers on the internet are scanned for weaknesses within minutes of going online. Spend ten minutes on these steps before you do anything else. Commands below are for Ubuntu and Debian; we note the equivalent for AlmaLinux and Rocky Linux where it differs.
1. Install updates
apt update && apt upgrade -y(AlmaLinux/Rocky: dnf upgrade -y)
2. Create a normal user with admin rights
adduser yourname
usermod -aG sudo yourname(AlmaLinux/Rocky: use the wheel group instead of sudo)
3. Set up SSH keys for that user, then test that you can log in with them in a new window before going further. See How do I connect to my VPS using SSH?
4. Turn off password and root logins. Edit /etc/ssh/sshd_config and set:
PermitRootLogin no
PasswordAuthentication noThen run systemctl restart ssh (AlmaLinux/Rocky: systemctl restart sshd).
5. Turn on the firewall, allowing only what you need:
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable(AlmaLinux/Rocky: use firewall-cmd)
6. Block repeated login attempts with Fail2ban: apt install fail2ban -y
7. Install security updates automatically: apt install unattended-upgrades -y
If you lock yourself out, the VNC console in the control panel still works. You can log in there and undo the change.
