2025 Checklist: Secure a Linux VPS Server in 20 Minutes
Every day, thousands of freshly provisioned VPS instances get scanned by bots in under 15 minutes. If you deploy projects on Hetzner, OVH, Scaleway, or any other provider, this guide is your first line of defense.
At Otomy, every server we configure for our clients (SMBs across France and Algeria) goes through this exact checklist. It's designed to be executed in 20 minutes on Ubuntu 22.04 / 24.04 or Debian 12.
Step 1 — Initial Connection & System Update (2 min)
ssh root@YOUR_IP
apt update && apt upgrade -y && apt autoremove -y
Why this matters: Unpatched CVEs are the #1 attack vector on VPS instances. An immediate update eliminates known vulnerabilities.
Enable automatic security updates:
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades
Step 2 — Create a Non-Root User with Sudo (2 min)
Never work as root. This is the golden rule.
adduser deploy
usermod -aG sudo deploy
Test the connection with your new user before proceeding:
ssh deploy@YOUR_IP
sudo whoami # should return "root"
Step 3 — SSH Key-Only Authentication (3 min)
On your local machine:
ssh-keygen -t ed25519 -C "deploy@myproject"
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_IP
Then on the server, lock down SSH configuration:
sudo nano /etc/ssh/sshd_config
Modify these lines:
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
sudo systemctl restart sshd
Otomy tip: We use 1Password SSH Agent or Secretive (macOS) to manage keys without files on disk.
Step 4 — Configure the UFW Firewall (2 min)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw enable
sudo ufw status verbose
If you host Supabase, n8n, or other services on custom ports, add them explicitly. Never open all ports.
Step 5 — Install and Configure Fail2Ban (3 min)
sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
Recommended configuration:
[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600
sudo systemctl enable fail2ban
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
Result: Any IP that fails 3 times within 10 minutes gets banned for 1 hour.
Step 6 — Harden the Kernel with Sysctl (2 min)
sudo nano /etc/sysctl.d/99-hardening.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
sudo sysctl --system
These settings block spoofing, ICMP redirects, and enable SYN cookies against basic DDoS attacks.
Step 7 — Set Up Minimal Monitoring (3 min)
No need for a full stack. Two tools are enough to get started:
Logwatch (daily email reports)
sudo apt install logwatch -y
sudo logwatch --detail Med --mailto your@email.com --range today
Netdata (real-time monitoring, web UI)
curl https://get.netdata.cloud/kickstart.sh > /tmp/netdata-kickstart.sh
sh /tmp/netdata-kickstart.sh --stable-channel
Important: Never expose it publicly. Use an SSH tunnel or a reverse proxy with authentication:
ssh -L 19999:localhost:19999 deploy@YOUR_IP -p 2222
Step 8 — DevSecOps Bonus: Automate the Audit (3 min)
Lynis — Automated Security Audit
sudo apt install lynis -y
sudo lynis audit system
Lynis generates a hardening score and actionable recommendations. At Otomy, we integrate this report into our CI/CD pipelines via GitHub Actions to audit every new deployment.
Automation with n8n
If you use n8n (which we frequently deploy for our clients), create a workflow that:
- Runs
lynis audit systemvia SSH - Parses the hardening score
- Sends a Slack/Telegram alert if the score drops below 70
Summary — Your 20-Minute Checklist
| Step | Action | Time |
|---|---|---|
| 1 | System update + unattended-upgrades | 2 min |
| 2 | Non-root user + sudo | 2 min |
| 3 | Ed25519 SSH key + harden sshd_config | 3 min |
| 4 | UFW: deny all, allow SSH/HTTP/HTTPS | 2 min |
| 5 | Fail2Ban on SSH | 3 min |
| 6 | Sysctl hardening | 2 min |
| 7 | Logwatch + Netdata | 3 min |
| 8 | Lynis audit + n8n alerts | 3 min |
What to Do AFTER These 20 Minutes
- Configure automated backups (Restic + B2 or S3)
- Deploy a reverse proxy with Caddy or Nginx and automatic TLS
- Set up CrowdSec as a community-driven Fail2Ban alternative
- Containerize your apps with Docker + isolated networks
- Schedule monthly Lynis audits with automation
Conclusion
Securing a Linux VPS in 2025 isn't optional — it's a prerequisite. These 20 minutes of investment save you weeks of pain in case of a breach.
At Otomy, we apply this checklist on every server we deploy for our clients, whether it hosts an e-commerce site, an n8n instance, a Supabase database, or a project deployed via Vercel with a dedicated backend.
Need a full security audit or managed DevSecOps? Get in touch with the Otomy team.