vps-hardeninglisted

# VPS Hardening A pragmatic baseline for a single Debian/Ubuntu VPS hosting a few services. Not a CIS benchmark — those are excellent but too long for a vibe-coded side project to follow on day one. This is the 30-minute version that gets you 90% of the way. Assumptions: you have root SSH access (typically via the provider's initial password). You will be the first and probably only operator. ## When to invoke - New VPS provisioned, no hardening yet - Inherited a VPS with no documentation - Service is about to face public internet traffic - Periodic re-audit (quarterly is reasonable) ## Step 0 — Get a backup before changing anything ```bash # From your laptop, snapshot the VPS via your provider's panel/API first. # All steps below are reversible, but a snapshot turns a mistake from a crisis into an inconvenience. ``` ## Step 1 — Update everything, then create a non-root user ```bash # As root, on the VPS apt update && apt upgrade -y apt install -y sudo ufw fail2ban unattended-upgrades curl ca-certificates gnupg # Create a personal user with sudo adduser deploy # set a strong passphrase (you will rarely use it) usermod -aG sudo deploy ``` From now on, prefer to SSH as `deploy` and use `sudo` for privileged actions. `root` will be locked from SSH in step 3. ## Step 2 — Authorize your SSH key for the new user From your **laptop**: ```bash ssh-copy-id deploy@<vps-ip> # Verify you can log in as deploy and run sudo ssh deploy@<vps-ip> 'sudo -v && echo OK