Secure a new server

A new server gets its first login attempts from strangers within minutes. Half an hour, once, covers most of what goes wrong. Work through it in order, with an SSH key on your computer first: see Make an SSH key and use it.

The two families name a few things differently:

1. Install updates#

A fresh image can be weeks old. Bring it up to date before anything else:

apt update && apt upgrade -y

dnf upgrade -y

If a new kernel came in, reboot now, and log in again when it's back:

reboot

2. Make your own user#

As root, one typo can do anything. Make an everyday user who uses sudo when it needs root. The examples use alex.

adduser alex

usermod -aG sudo alex

useradd -m -G wheel alex

passwd alex

Copy root's SSH keys to the new user, so the same key lets you in:

install -d -m 700 -o alex -g alex /home/alex/.ssh

install -m 600 -o alex -g alex /root/.ssh/authorized_keys /home/alex/.ssh/authorized_keys

Keeping this window open, log in as the new user from a second terminal:

ssh [email protected]

Check sudo works. It asks for alex's password and should answer root:

sudo whoami

3. Allow SSH keys only#

Turn off password logins, and let root in with a key only. Bots guessing passwords then get nowhere.

Put the settings in their own file. The first value SSH finds wins, so a name starting 00- beats anything the image put there:

sudo tee /etc/ssh/sshd_config.d/00-key-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF

Check the settings make sense, then see what SSH will actually use:

sudo sshd -t

sudo sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin)'

The first two should say no and the last without-password (SSH's name for prohibit-password). Then restart SSH. Open sessions stay open.

sudo systemctl restart ssh

sudo systemctl restart sshd

From a third terminal, check you can still get in with your key:

ssh [email protected]

Only when that works, close the old sessions.

4. Turn on a firewall#

Allow SSH before you turn it on.

sudo ufw allow 22/tcp

sudo ufw enable

sudo ufw status verbose

sudo dnf install -y firewalld && sudo systemctl enable --now firewalld

sudo firewall-cmd --list-all

sudo firewall-cmd --permanent --add-service=http --add-service=https && sudo firewall-cmd --reload

Two firewalls, one path

A VPS also has a firewall in the portal, outside the server, on the Networking tab: see Set up the firewall. Traffic passes it first, then the server's own, so a port has to be open in both.

5. Ban repeat offenders with fail2ban#

Bots keep knocking even with passwords off. fail2ban blocks an address for a while after repeated failed logins.

sudo apt install -y fail2ban

sudo dnf install -y epel-release && sudo dnf install -y fail2ban

Tell it to watch SSH, reading the system journal:

sudo tee /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h
EOF

Start it, and have it start at every boot:

sudo systemctl enable --now fail2ban && sudo systemctl restart fail2ban

See who's banned:

sudo fail2ban-client status sshd

If you ever ban yourself, wait an hour or unban your address from the console: sudo fail2ban-client set sshd unbanip 198.51.100.7.

6. Install security updates automatically#

Let the server install security fixes by itself:

sudo apt install -y unattended-upgrades

sudo tee /etc/apt/apt.conf.d/20auto-upgrades <<'EOF'
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
EOF

sudo dnf install -y dnf-automatic

sudo systemctl enable --now dnf-automatic-install.timer

Kernel updates still need a reboot to take effect. See Keep your server updated for checking that, and for automatic reboots.

What's next#

• Point a domain at it: Point a domain at your server.
• Put a website on it: Host a website with HTTPS using Caddy.
• Make sure you can recover it: Back up your server.