[{"data":1,"prerenderedAt":174},["ShallowReactive",2],{"seo-verification":3,"blog-initial-linux-server-hardening-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":26,"intro":29,"sections":30,"ctaTitle":121,"ctaBody":122,"ctaButton":123,"ctaUrl":124,"relatedPosts":125},228,"initial-linux-server-hardening",{"fr":10,"en":8,"ar":11},"durcissement-serveur-linux-initial","تصليب-الخادم-linux-الأولي","Initial Linux Server Hardening","Create a sudo user, configure SSH with keys, enable UFW and fail2ban on Ubuntu 22.04 or Debian 12 in under an hour.",10,0,false,"2026-08-06T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdurcissement-serveur-linux-initial-poster.svg","A freshly provisioned VPS is never secure by default: root SSH access is open, no firewall filters incoming traffic, and no system detects intrusion attempts. Within a few dozen minutes, you can drastically reduce your attack surface. This guide walks you through every step on Ubuntu 22.04 and Debian 12, from creating a sudo user to enabling automatic security updates.",[31,35,46,49,56,81,84,87,115,118],{"type":32,"title":33,"body":34},"h2","Why your VPS is vulnerable from the moment it's delivered","As soon as an IP address is assigned to your server, automated bots begin scanning it. Shodan, Censys, and thousands of malicious bots continuously catalog open ports across the Internet. A fresh Linux server exposes port 22 by default, with the root user accessible from any IP address worldwide. If your root password is weak — or if you reused a password already leaked in a data breach — your server can be compromised within hours or even minutes. Without a firewall, every port opened by your future applications is also reachable without restriction. Without an intrusion detection system, you will receive no alert when a brute-force attack is underway. This guide fixes these three fundamental problems using proven tools available directly in your distribution's official repositories.",{"type":36,"title":37,"items":38},"ul","What this guide sets up",[39,40,41,42,43,44,45],"**Non-root user with sudo** — reduces attack surface by disabling direct root logins on your server","**SSH key authentication** — eliminates brute-force attacks on passwords, only your private key grants access","**Disabled root SSH access** — even if the root password is compromised, direct login remains impossible","**UFW firewall** — blocks all incoming traffic by default and only allows explicitly declared ports","**fail2ban** — automatically bans IP addresses that make repeated failed connection attempts","**Automatic security updates** — critical patches apply without daily manual intervention on your server","**System clock synchronization** — ensures consistent logs and valid TLS certificates across services",{"type":32,"title":47,"body":48},"Prerequisites before you start","Before following this guide, make sure you have everything you need. Proper preparation will prevent you from getting stuck mid-way, especially during SSH configuration where a mistake can lock you out of the server entirely.",{"type":36,"title":50,"items":51},"What you need",[52,53,54,55],"**Working root SSH access** — you must be able to connect with `ssh root@your-server.com` before starting","**Ubuntu 22.04 LTS or Debian 12** — this guide is tested on both distributions, commands are identical","**A locally generated SSH key pair** — run `ssh-keygen -t ed25519` on your machine if you don't have one yet","**A terminal with two tabs open** — always keep an active root session during SSH configuration to avoid lockouts",{"type":57,"title":58,"steps":59},"steps","The 7 hardening steps",[60,63,66,69,72,75,78],{"title":61,"body":62},"Update the system","Start by syncing the package list and applying all available patches: `apt update && apt upgrade -y`. Reboot if a new kernel was installed: `reboot`. Reconnect as root after the reboot before proceeding to the next step.",{"title":64,"body":65},"Create a non-root user with sudo","Create a new user that will be your daily working account. Replace `deploy` with a name of your choice: `adduser deploy`. Follow the prompts to set a strong password. Then add this user to the sudo group: `usermod -aG sudo deploy`. Verify the addition worked: `groups deploy` should display `deploy sudo`.",{"title":67,"body":68},"Copy your SSH key to the new user","From your local machine, copy your public key to the `deploy` account: `ssh-copy-id deploy@your-server.com`. If `ssh-copy-id` is unavailable, copy manually by connecting as `deploy`, then run: `mkdir -p ~\u002F.ssh && chmod 700 ~\u002F.ssh` and paste your public key into `~\u002F.ssh\u002Fauthorized_keys` with `chmod 600 ~\u002F.ssh\u002Fauthorized_keys`. Immediately test the connection in a new tab: `ssh deploy@your-server.com` — do not close the root session until this connection is confirmed.",{"title":70,"body":71},"Harden SSH configuration","Edit the SSH daemon configuration file: `nano \u002Fetc\u002Fssh\u002Fsshd_config`. Modify or add these directives: `PermitRootLogin no` to forbid direct root access, `PasswordAuthentication no` to disable password authentication, and optionally `Port 2222` to change the listening port (remember to open this port in UFW before restarting). Reload the configuration: `systemctl reload sshd`. Immediately test the connection with the new user from another terminal before closing your current session.",{"title":73,"body":74},"Configure UFW firewall","Install UFW if needed: `apt install ufw -y`. Set the default policy: `ufw default deny incoming` and `ufw default allow outgoing`. Allow the ports you need — if you changed the SSH port: `ufw allow 2222\u002Ftcp`, otherwise `ufw allow 22\u002Ftcp`. Add web ports: `ufw allow 80\u002Ftcp` and `ufw allow 443\u002Ftcp`. Enable the firewall: `ufw enable`. Confirm with `Y` when prompted. Verify the status: `ufw status verbose`.",{"title":76,"body":77},"Install and configure fail2ban","Install fail2ban: `apt install fail2ban -y`. Create a local configuration file to prevent your settings from being overwritten during updates: `cp \u002Fetc\u002Ffail2ban\u002Fjail.conf \u002Fetc\u002Ffail2ban\u002Fjail.local`. Edit `jail.local` to enable SSH protection: in the `[sshd]` section, ensure `enabled = true` is present and set `bantime = 1h`, `findtime = 10m`, `maxretry = 5`. Restart and enable the service: `systemctl enable --now fail2ban`. Verify that the SSH jail is active: `fail2ban-client status sshd`.",{"title":79,"body":80},"Enable automatic security updates","Install the unattended-upgrades package: `apt install unattended-upgrades -y`. Run the configuration wizard: `dpkg-reconfigure -plow unattended-upgrades` and answer `Yes`. To verify that automatic security updates are enabled, check `\u002Fetc\u002Fapt\u002Fapt.conf.d\u002F20auto-upgrades`: both lines `APT::Periodic::Update-Package-Lists \"1\";` and `APT::Periodic::Unattended-Upgrade \"1\";` must be present. Also ensure systemd-timesyncd is active to keep the clock accurate: `systemctl status systemd-timesyncd`.",{"type":82,"body":83},"tip","Critical tip: ALWAYS test the SSH connection with your new user in a second terminal BEFORE closing your root session. If you close the root session without verifying that key authentication works for `deploy`, you risk being permanently locked out of your server. If in doubt, use the KVM\u002FVNC console available in your ServOrbit control panel.",{"type":32,"title":85,"body":86},"Going further after initial hardening","Once the seven steps are complete, your server is considerably more secure than when it was delivered. But security is a continuous process, not a fixed state. Several complementary tools can further strengthen your security posture depending on your context. For environments that must meet compliance requirements (GDPR, PCI-DSS, ISO 27001), install `auditd`: `apt install auditd -y` then `systemctl enable --now auditd`. This daemon logs all sensitive system calls — command execution, file modifications, connections — and facilitates regulatory audits. For more advanced protection against botnets and coordinated scans, CrowdSec is an excellent alternative to fail2ban: it analyzes behaviors collaboratively, shares IP reputations among its users, and includes modern supervision dashboards. Our dedicated article details its installation and configuration on Ubuntu and Debian.",{"type":88,"title":89,"headers":90,"rows":94},"comparison","fail2ban vs CrowdSec: which one to choose?",[91,92,93],"Criterion","fail2ban","CrowdSec",[95,99,103,107,111],[96,97,98],"Installation ease","Very simple (apt)","Simple (official script)",[100,101,102],"Collective intelligence","No (local only)","Yes (shared database)",[104,105,106],"Supervision interface","CLI only","Web dashboard included",[108,109,110],"Resource consumption","Very low","Low to moderate",[112,113,114],"Best for","Simple servers, beginners","Multi-server infra, compliance",{"type":32,"title":116,"body":117},"Troubleshooting: common post-hardening issues","Even with a careful procedure, you may find yourself locked out or facing unexpected behavior. Here are the three most common situations and how to resolve them. First case: you locked yourself out of SSH. Connect via the KVM or VNC console in your ServOrbit panel, which provides direct server access independent of SSH. Once connected via console, you can fix the sshd configuration, add your key to `authorized_keys`, or reset a password. Second case: fail2ban banned your own IP address. Unban yourself from the console or from another IP: `fail2ban-client set sshd unbanip YOUR_IP`. To prevent this from recurring, add your static IP in the `[DEFAULT]` section of `jail.local`: `ignoreip = 127.0.0.1\u002F8 YOUR_IP`. Third case: you changed the SSH port but forgot to open it in UFW before restarting sshd. Reconnect via console, add the missing rule `ufw allow 2222\u002Ftcp` and run `ufw reload`.",{"type":32,"title":119,"body":120},"Conclusion","In under an hour, you have transformed a vulnerable server into a solid foundation: root SSH access is disabled, only cryptographic keys allow login, a firewall filters all unauthorized traffic, fail2ban automatically blocks attackers, and security patches apply without manual intervention. These seven steps represent the absolute minimum for any server exposed to the Internet. They do not replace application-level security (HTTPS, security headers, input validation) but they close the most exploited attack vectors on Linux VPS instances. Consider documenting them in your team runbook and applying them systematically to every new server you provision.","A Linux VPS ready to harden in 60 seconds","All ServOrbit VPS instances are delivered with Ubuntu 22.04 or Debian 12, immediate root SSH access and KVM console included. Apply this guide upon delivery and start on solid foundations.","Order a Linux VPS","\u002Fvps-cloud",[126,143,160],{"id":127,"slug":128,"slugs":129,"title":132,"excerpt":133,"readTime":134,"views":15,"isPinned":16,"publishedAt":135,"category":136,"categories":137,"featuredImage":26,"bgImage":27,"posterImage":139,"relatedSolution":140},108,"securing-your-vps-with-crowdsec",{"fr":130,"en":128,"ar":131},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.",4,"2026-03-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[138],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":141,"appSlug":142},"cybersecurity-bastion","crowdsec",{"id":144,"slug":145,"slugs":146,"title":149,"excerpt":150,"readTime":151,"views":15,"isPinned":16,"publishedAt":152,"category":153,"categories":154,"featuredImage":26,"bgImage":27,"posterImage":156,"relatedSolution":157},109,"fail2ban-enhanced-on-vps-blocking-repeated-attacks",{"fr":147,"en":145,"ar":148},"proteger-vps-fail2ban","fail2ban-enhanced-على-خادم-vps-حجب-الهجمات-المتكررة","Fail2Ban Enhanced on VPS: blocking repeated attacks","Link Fail2Ban Enhanced to the ServOrbit catalog: SSH\u002FNginx banning, readable logs and official documentation.",3,"2026-03-03T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[155],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fproteger-vps-fail2ban-poster.svg",{"categorySlug":158,"appSlug":159},"securite","fail2ban-enhanced",{"id":161,"slug":162,"slugs":163,"title":166,"excerpt":167,"readTime":134,"views":168,"isPinned":16,"publishedAt":169,"category":170,"categories":171,"featuredImage":26,"bgImage":27,"posterImage":173,"relatedSolution":26},224,"self-hosted-apps-the-patching-routine",{"fr":164,"en":162,"ar":165},"routine-correctifs-apps-self-hosted","التطبيقات-المستضافة-ذاتيا-روتين-التصحيحات","Self-hosted apps: the patching routine","Inventory, security advisories, a patch window, backups and post-checks: the routine most self-hosted estates are missing.",1,"2026-08-05T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[172],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Froutine-correctifs-apps-self-hosted-poster.svg",1787581006939]