Secure an Ubuntu 26.04 VPS

Introduction

Securing your VPS is crucial to protect your data and services from unauthorized access and attacks. This guide covers essential security measures you should implement on your server.

Prerequisites

• A VPS with SSH access
• Root or sudo privileges
• Completed the Getting Started with VPS guide

Step 1: Disable Root Login

Running services as root is a security risk. Let’s disable direct root login via SSH.

Edit SSH Configuration

sudo nano /etc/ssh/sshd_config

Find and modify these lines:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Validate and reload SSH safely

sudo sshd -t
sudo systemctl reload ssh

Step 2: Configure Advanced Firewall Rules

Beyond basic UFW setup, let’s add rate limiting to prevent brute-force attacks.

Enable Rate Limiting for SSH

sudo ufw limit ssh

This applies UFW’s rate-limiting profile to new SSH connections. It slows repeated attempts but does not replace key authentication or monitoring.

Configure Application-Specific Rules

For a web server:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

View All Rules

sudo ufw status numbered

Delete a Rule

sudo ufw delete [number]

Step 3: Install and Configure Fail2Ban

Fail2Ban monitors log files and bans IPs that show malicious behavior.

Install Fail2Ban

sudo apt install fail2ban -y

Create a minimal local override

sudo nano /etc/fail2ban/jail.d/sshd.local

Configure SSH Protection

Add only the SSH settings you want to override. Package updates can then continue to update the distribution defaults:

[sshd]
enabled = true
port = ssh
filter = sshd
backend = systemd
maxretry = 3
bantime = 3600
findtime = 600

This configuration:

• Bans IPs after 3 failed login attempts
• Ban lasts 1 hour (3600 seconds)
• Monitors attempts within 10 minutes (600 seconds)

The systemd backend reads SSH events from the journal, so this override does not hardcode a legacy log-file path.

Apply the configuration

sudo fail2ban-client -t
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban
sudo systemctl status fail2ban --no-pager

Check Fail2Ban Status

sudo fail2ban-client status
sudo fail2ban-client status sshd

Unban an IP

If you accidentally ban yourself:

sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

Step 4: Enable Automatic Security Updates

Keep your system patched automatically for security updates.

Install Unattended Upgrades

sudo apt install unattended-upgrades -y

Configure Automatic Updates

sudo dpkg-reconfigure -plow unattended-upgrades

Select “Yes” when prompted.

Customize Update Settings

Edit the configuration:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Ensure these lines are uncommented:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

Need Help?

Security questions or concerns?

• Join our Discord community
• Email: shrp@shrp.no

Remember: Security is a continuous process, not a one-time setup. Stay vigilant and keep your systems updated!