Setting Up Your Own VPS: A Secure Starting Point

Description and use

Secure VPS setup: patching, non‑root user, SSH key hardening, UFW firewall, unattended upgrades, and Docker port binding.

Problem

New VPS instances are vulnerable immediately after launch due to default configurations that allow root access, password authentication, open ports, and lack of automatic updates.

Outcome

A hardened VPS ready for secure self‑hosting: patched, key‑only SSH, restricted firewall, automatic updates, and Docker port safety.

Workflow

• Log in as root and run apt update && apt upgrade -y and reboot if kernel updated.
• Create a non‑root sudo user with adduser deploy and usermod -aG sudo deploy.
• Generate an ed25519 SSH key pair locally with ssh-keygen -t ed25519 -C "you@your-machine" and copy it to the server with ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_SERVER_IP.
• Configure SSH hardening by creating /etc/ssh/sshd_config.d/99-hardening.conf with PermitRootLogin no, PasswordAuthentication no, etc., test with sshd -t and sshd -T, then reload SSH.
• Install UFW (sudo apt install -y ufw), set default deny incoming, allow outgoing, allow OpenSSH and web ports, enable UFW and verify status.
• Install and configure unattended-upgrades to apply security updates automatically, test with --dry-run.
• Optionally install fail2ban to ban repeated SSH failures.
• Address Docker firewall bypass by binding published ports to 127.0.0.1 or not publishing internal services at all.

Evidence

Never do daily work as root. Create a sudo user and log in as that instead.

Source

Docker bypasses UFW. When you publish a container port, Docker writes its own firewall rules that skip UFW entirely.

Source