Why Securing Your Cloud VPS Is Essential

The moment you deploy a new Linux instance on the internet, automated botnets and malicious scrapers immediately begin port scanning and attempting brute-force SSH logins. Unsecured servers are often compromised within hours and recruited into DDoS botnets or crypto mining rings.

Follow this step-by-step production hardening guide to secure your VexaNode Cloud VPS.

Step 1: Create a Dedicated Sudo User

Never run daily services or applications under the default root account. Create a standard user with elevated sudo privileges:

# Create new user
adduser deployer

# Add user to sudo group
usermod -aG sudo deployer

Step 2: Configure SSH Key-Based Authentication

Password authentication is vulnerable to brute-force dictionary attacks. Generate an Ed25519 SSH keypair on your local machine:

# On your local computer
ssh-keygen -t ed25519 -C "admin@vexanode"

# Copy key to remote server
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@YOUR_SERVER_IP

Step 3: Harden SSH Daemon Configuration

Edit the SSH daemon config file /etc/ssh/sshd_config:

# Change standard SSH port to reduce bot noise
Port 2222

# Disable root login
PermitRootLogin no

# Disable password authentication entirely
PasswordAuthentication no
PubkeyAuthentication yes

# Disable empty passwords
PermitEmptyPasswords no

# Maximum authentication attempts
MaxAuthTries 3

Validate the syntax and restart SSH:

sudo sshd -t
sudo systemctl restart sshd

Step 4: Configure UFW (Uncomplicated Firewall)

Block all incoming connections by default and only allow explicitly approved ports:

# Default rules
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow custom SSH port
sudo ufw allow 2222/tcp

# Allow Web traffic (if hosting HTTP/HTTPS)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable firewall
sudo ufw enable
sudo ufw status verbose

Step 5: Install Fail2ban for Brute-Force Defense

Fail2ban monitors system authentication logs and automatically adds temporary firewall drop rules for IP addresses exhibiting suspicious behavior:

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban

Step 6: Enable Automated Unattended Security Updates

Keep security patches up-to-date automatically without manual intervention:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades