Secure a PME VPS in 1 hour: Debian/Ubuntu hardening step by step

Before production on a rented VPS, here is 1 hour of hardening that makes it suitable for production SME use.

1. Update + non-root user

apt update && apt upgrade -y · create user ops + sudo · add SSH public key to /home/ops/.ssh/authorized_keys

2. SSH hardening

Edit /etc/ssh/sshd_config : Port 2222, PermitRootLogin no, PasswordAuthentication no, AllowUsers ops, MaxAuthTries 3. Reload. Test new terminal BEFORE closing admin session.

3. UFW firewall

ufw default deny incoming · allow 2222/tcp · allow 80/443 if web · ufw enable

4. Fail2ban

jail.local : bantime 1h, maxretry 5, backend systemd. Enable sshd jail on port 2222.

5. Automatic updates

apt install unattended-upgrades + auto-reboot at 4am if kernel patch.

6. Audit logs auditd

Rules : monitor /etc/passwd, /etc/sudoers, sudo. ausearch -k sudo_log to query.

7. Time sync + locale

timedatectl set-timezone Europe/Paris + systemd-timesyncd.

8. Disable unnecessary services

Disable snapd, bluetooth, ModemManager if unused.

9. Sysctl hardening

SYN cookies, ICMP broadcast ignore, anti-spoofing rp_filter, log_martians, disable IPv6 if unused.

10. SSH MFA (optional)

libpam-google-authenticator + AuthenticationMethods publickey,keyboard-interactive.

Conclusion

1 hour invested = production-grade VPS. Optional monitoring next: Wazuh, Netdata, Prometheus. KOLOSALTech configures production-grade VPS + monitoring in our infrastructure services.