The Complete Linux VPS Hardening Guide: SSH Keys, UFW & Fail2Ban

When deploying an unmanaged KVM VPS with full root access, security responsibility rests entirely in your hands. Within minutes of an IP address becoming active on the public internet, automated botnets begin probing port 22 for weak passwords.

Step 1: Disable Password Authentication & Enforce SSH Keys

Password brute-forcing is the #1 vector for VPS compromise. Replace password authentication with a 4096-bit RSA or Ed25519 cryptographic key pair:

# Generate key on your local machine:
ssh-keygen -t ed25519 -C "admin@yourvps"

# Copy public key to server:
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@YOUR_SERVER_IP

Next, modify /etc/ssh/sshd_config to disable password logins permanently:

PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin prohibit-password

Step 2: Change Default SSH Port

Moving SSH away from port 22 cuts automated log noise by over 98%. Pick an unassigned high port such as 49222:

# In /etc/ssh/sshd_config:
Port 49222

# Reload SSH service:
systemctl restart sshd

Step 3: Setup UFW (Uncomplicated Firewall)

Lock down all inbound ports and only open the specific application ports you require:

ufw default deny incoming
ufw default allow outgoing
ufw allow 49222/tcp comment 'SSH Port'
ufw allow 80/tcp comment 'HTTP'
ufw allow 443/tcp comment 'HTTPS'
ufw enable

Step 4: Install and Configure Fail2Ban

Fail2Ban monitors log files and dynamically injects firewall rules to ban IP addresses exhibiting malicious signs (like repeated failed logins):

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban