vps-security-hardening

VPS Security Hardening

Audit and harden VPS security with fail2ban (brute-force protection), SSH hardening, and optional firewall setup.

When to Use

• New VPS setup (initial hardening)
• Security audit requested
• SSH brute-force attacks detected
• User wants to "secure VPS" or "protect server"

Prerequisites: Establishing SSH Access

Before hardening, ensure you can SSH into the VPS.

If Password Auth is Disabled (PublicKey only)

VPS providers often disable password auth by default. You need to add your SSH key first.

Option 1: Via VPS Web Console (Recommended)

1. Generate SSH key locally (if not exists):

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N '' -C "user@machine"
   cat ~/.ssh/id_ed25519.pub
   

2. Login to VPS via web console (provider dashboard → Console/Terminal)

3. Add public key to VPS:

   mkdir -p ~/.ssh
   echo "ssh-ed25519 AAAA... user@machine" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
   

4. Test from local machine:

   ssh root@VPS_IP
   

Option 2: Via Provider Dashboard

Most providers (DigitalOcean, Vultr, Biznet, etc.) have "Add SSH Key" in dashboard:

• Copy public key (cat ~/.ssh/id_ed25519.pub)
• Paste into provider's SSH key management
• Rebuild/restart VPS (some providers require this)

Option 3: Enable Password Auth Temporarily

Only if web console is unavailable:

1. Login via web console
2. Edit SSH config:

   echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config.d/99-temp-password.conf
   systemctl reload sshd
   

3. SSH in with password, add your key
4. Remove temp config:

   rm /etc/ssh/sshd_config.d/99-temp-password.conf
   systemctl reload sshd
   

Common Pitfall: sshpass with PublicKey-Only VPS

Problem: sshpass -p 'password' ssh user@host fails with "Permission denied (publickey)" even with correct password.

Why: VPS has PasswordAuthentication no in sshd_config — password auth is disabled at server level.