How to Secure Your VPS After the First Login: Essential Steps

You've just ordered a new VPS, connected for the first time as root, and now you're wondering: what's next? The first 30–60 minutes on a new server are critical. An unprotected VPS becomes a target for automated bots within hours of going live — this isn't an exaggeration; it's a reality confirmed by the logs of any public-facing server.

This guide gives you concrete, correctly ordered steps to put your Linux VPS on a solid security foundation from day one.

1. Update the Operating System Immediately

Your first action after connecting: update all packages. For Debian/Ubuntu-based distributions:

apt update && apt upgrade -y

For CentOS/AlmaLinux/Rocky Linux:

dnf update -y

These commands install available security patches and eliminate known vulnerabilities in outdated package versions. Don't skip this step, even if the VPS image looks recent.

2. Create a New User and Stop Using Root for SSH

Working directly as root is dangerous: any mistake or unauthorized access has maximum consequences. Create a user with administrative privileges:

adduser myadmin
usermod -aG sudo myadmin

On CentOS/AlmaLinux, the group is called wheel:

usermod -aG wheel myadmin

Set a strong password (or better yet: use SSH keys exclusively — see the next step):

passwd myadmin

3. Set Up SSH Key Authentication

Passwords can be cracked via brute-force attacks. SSH keys are far more secure. On your local machine (not the server), generate a key pair:

ssh-keygen -t ed25519 -C "vps-cliqhost"

Copy the public key to the server:

ssh-copy-id myadmin@SERVER_IP

Or manually — add the contents of ~/.ssh/id_ed25519.pub to /home/myadmin/.ssh/authorized_keys on the server.

Always verify you can connect with the new key before disabling password authentication!

ssh -i ~/.ssh/id_ed25519 myadmin@SERVER_IP

4. Harden Your SSH Configuration (sshd_config)

Edit the SSH service configuration file:

nano /etc/ssh/sshd_config

Modify or add these directives:

Port 2222                  # Change the default port (22)
PermitRootLogin no         # Disable direct root login
PasswordAuthentication no  # Disable password-based authentication
PubkeyAuthentication yes   # Enable SSH key authentication
MaxAuthTries 3             # Limit authentication attempts
LoginGraceTime 30          # Maximum time to authenticate (seconds)
X11Forwarding no           # Disable X11 forwarding if not needed

Restart the SSH service:

systemctl restart sshd

Warning: Do NOT close your current session before verifying you can connect on the new port with the new user!

ssh -p 2222 myadmin@SERVER_IP

5. Configure a Firewall

On Ubuntu/Debian — UFW (Uncomplicated Firewall)

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp        # New SSH port
ufw allow 80/tcp          # HTTP
ufw allow 443/tcp         # HTTPS
ufw enable
ufw status verbose

On CentOS/AlmaLinux — firewalld

firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all

A properly configured firewall blocks tens of thousands of malicious requests daily — it's one of the most effective security measures you can take.

6. Install and Configure Fail2Ban

Fail2Ban monitors system logs and automatically bans IP addresses attempting brute-force attacks:

apt install fail2ban -y        # Debian/Ubuntu
dnf install fail2ban -y        # CentOS/AlmaLinux

Create a local configuration file (never edit jail.conf directly):

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
nano /etc/fail2ban/jail.local

The most important settings in the [sshd] section:

[sshd]
enabled  = true
port     = 2222
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5
bantime  = 3600
findtime = 600

Enable and start the service:

systemctl enable fail2ban
systemctl start fail2ban
fail2ban-client status sshd

7. Disable Unnecessary Services

Every active service is a potential attack surface. Check what's running:

systemctl list-units --type=service --state=running

Disable anything you don't need, such as avahi-daemon, cups, or bluetooth:

systemctl disable --now avahi-daemon

On a minimal VPS: the fewer active services, the better.

8. Enable Automatic Security Updates

Debian/Ubuntu — unattended-upgrades

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

This utility automatically installs only security updates, without touching packages that could cause compatibility issues.

CentOS/AlmaLinux — dnf-automatic

dnf install dnf-automatic -y

Edit /etc/dnf/automatic.conf and set apply_updates = yes, then enable the timer:

systemctl enable --now dnf-automatic.timer

9. Monitor Logs and Server Activity

Knowing what's happening on your server is an essential part of security. A few useful commands:

# Recent SSH authentication attempts
journalctl -u sshd --since "1 hour ago"

# Last logged-in users
last -n 20

# Top resource-consuming processes
top
htop  # if installed

# Active network connections
ss -tulpn

For more advanced monitoring, consider installing Netdata or Glances:

apt install glances -y
glances

10. Change the Root Password and Protect sudo Access

Even if you've disabled root SSH login, the root password must be strong — you may need it from the VPS console (KVM/VNC access):

passwd root

To log all commands run via sudo, add this to /etc/sudoers.d/audit:

Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output

Post-Installation Security Checklist

#	Action	Status
1	System updated	✅
2	Non-root user created	✅
3	SSH keys configured	✅
4	SSH hardened (port changed, root login disabled)	✅
5	Firewall active	✅
6	Fail2Ban installed	✅
7	Unnecessary services disabled	✅
8	Automatic security updates enabled	✅
9	Log monitoring in place	✅
10	Root password changed	✅

Conclusion

Securing a VPS is not optional — it's a fundamental requirement. These ten steps don't demand advanced Linux expertise, but they make all the difference between a server that holds up and one that gets compromised within hours. Invest an hour at first login for these configurations and you'll avoid serious headaches down the road.

If you'd rather focus on your project without managing server security manually, CLIQHOST offers managed VPS solutions with initial configuration included and technical support always within reach.

How to Secure Your VPS After the First Login: Essential Steps