Hardening an offshore VPS on day one

A new public address starts receiving credential-stuffing attempts within minutes. Almost none of it is targeted at you specifically, and almost all of it is stopped by four changes that take twenty minutes. Do them before you install anything else.

The order

1. 01Keys only, no passwordsInstall your public key, then set PasswordAuthentication no and PermitRootLogin prohibit-password. Confirm a new session works before closing the one you have — locking yourself out on step one is a rite of passage nobody needs.
2. 02Default-deny firewallnftables or ufw. Allow SSH and the ports your service genuinely needs. Everything else drops. Remember IPv6: a v4-only ruleset on a dual-stacked machine is an open door with a closed sign on it.
3. 03Unattended security updatesEnable them. An unpatched service is a far more common cause of losing a server than any legal process.
4. 04fail2ban or equivalentBan repeated failures. This mostly cleans your logs rather than stopping a real attacker, but a readable log is what lets you see the real attacker.

Then the things people skip

• Backups that leave the machine. A snapshot on the same provider is not a backup; it is a copy in the same building. Push encrypted archives to a storage volume elsewhere, ideally in another region.
• Test a restore. An untested backup is a hypothesis. Restore it once, now, while nothing is on fire.
• A non-root user with sudo for daily work. Not because root is dangerous in itself, but because the habit limits blast radius.
• Encrypt the data volume if the workload justifies it. Powered off, an encrypted disk is a brick to anyone holding it.

What not to bother with

Changing the SSH port stops log noise and nothing else; a scanner finds it in seconds. Port-knocking adds a moving part that will eventually lock you out at the worst moment. Elaborate intrusion-detection stacks on a single server generate alerts nobody reads. Keys, a real firewall, current packages and a backup you have restored once will carry you further than any of it.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.