Basic Server Security Hardening: SSH, Firewall and fail2ban

Right after a new server is provisioned, it's worth running a quick round of basic hardening. It blocks the vast majority of automated scans and brute-force attempts. The commands below target Debian/Ubuntu and are copy-paste ready.

1. Update the system first

apt update && apt upgrade -y

2. Use key auth, disable root password login

On your local machine, generate a key and copy it to the server:

ssh-keygen -t ed25519
ssh-copy-id root@YOUR_SERVER_IP

Once key login works, edit /etc/ssh/sshd_config:

PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes

3. Change the SSH port

In the same file, switch the port (example uses 22000):

Port 22000

Save and restart SSH: systemctl restart ssh. Important: open the new port in the firewall *before* changing it, or you'll lock yourself out.

If your plan is a NAT instance (shared IPv4 with a mapped port range), only use the port range assigned to you and check the mapping on the service detail page.

4. Enable a firewall (ufw)

apt install ufw -y
ufw allow 22000/tcp
ufw enable

Only open the ports you actually need (e.g. 80, 443).

5. Install fail2ban

apt install fail2ban -y
systemctl enable --now fail2ban

It auto-bans IPs after repeated failed logins. Tune the ban time in /etc/fail2ban/jail.local.

6. Use strong passwords

Even when relying on keys, give root and other accounts sufficiently complex passwords.

If you ever get locked out, log in via the VNC console or the browser SSH terminal on the service detail page to fix things — or use reset password / reinstall OS.

Still stuck?

Need a hand? Open a ticket at Dashboard → Tickets (/dashboard/tickets/new), link the affected service, and we'll help out.