How to secure a VPS: UFW, fail2ban and key-only SSH
Bots scan every public IP address looking for weak logins within minutes of a server going online. A few simple steps stop most of them. Commands here target Ubuntu and Debian and may vary on other distributions. DDoS protection is included on Tabi Cloud plans, but server-level hardening is still your job.
1. Set up a firewall with UFW
Allow SSH first, or you will lock yourself out.
- sudo apt install ufw -y
- sudo ufw allow OpenSSH
- sudo ufw allow 80/tcp
- sudo ufw allow 443/tcp
- sudo ufw enable
- sudo ufw status verbose
Only open ports for services you really run. If you change the SSH port, allow that port before enabling.
2. Install fail2ban
It bans IPs that repeatedly fail to log in.
- sudo apt install fail2ban -y
- sudo systemctl enable --now fail2ban
- sudo fail2ban-client status sshd
To customise, copy /etc/fail2ban/jail.conf to /etc/fail2ban/jail.local and edit there so updates do not overwrite your changes.
3. Disable password login
Only do this after your SSH key works. Keep a second session open while you test.
- sudo nano /etc/ssh/sshd_config
- Set PasswordAuthentication no
- Set PermitRootLogin no, or prohibit-password if you still need root with keys
- sudo sshd -t to check for errors
- sudo systemctl restart ssh
On some systems the service is called sshd, so use that name if ssh fails. Test a new login in another terminal before closing the old one.
4. Keep things updated
- sudo apt update and sudo apt upgrade regularly
- sudo apt install unattended-upgrades for automatic security patches
5. Other good habits
- Use a unique non-root user for daily work
- Remove software you do not use
- Do not expose databases to the whole internet, bind them to 127.0.0.1 unless needed
- Check logs with sudo journalctl -u ssh or sudo tail /var/log/auth.log
Quick check
Run sudo ss -tulpn to list listening ports. If you see something you do not recognise, find out what it is.
Questions? Open a ticket on our Discord or email support.