Securing a fresh VPS: a starter checklist

Root access on a VPS means the security of the box is your responsibility, not a shared, pre-hardened environment like Shared Hosting. None of this takes long, but doing it before you deploy anything saves a lot of trouble later.

1. Create a non-root user

Don't operate day-to-day as root. Create a user with sudo privileges instead:

adduser deploy
usermod -aG sudo deploy

Log out and back in as that user for everything that isn't system administration.

2. Switch to SSH key authentication

Password-based SSH logins are the most common thing automated scanners try to brute-force. Generate a key pair on your own machine, copy the public key to the server, then disable password logins entirely:

ssh-copy-id deploy@your-server-ip

Then edit /etc/ssh/sshd_config, set PasswordAuthentication no and PermitRootLogin no, and restart the SSH service.

3. Turn on the firewall

Every Byytes VPS ships with a configurable firewall you can manage from your account panel, or directly with ufw on the server:

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Only open the ports your application actually needs. It's easier to add a port later than to figure out what's been exposed for months.

4. Install fail2ban

Fail2ban watches log files for repeated failed login attempts and temporarily bans the offending IP address, a lightweight extra layer on top of key-only SSH access:

apt install fail2ban
systemctl enable --now fail2ban

5. Turn on automatic security updates

Security patches for your OS and installed packages don't apply themselves. On Ubuntu or Debian:

apt install unattended-upgrades
dpkg-reconfigure --priority=low unattended-upgrades

6. Set up backups before you need them

Every VPS plan includes weekly backups by default, visible under Backups in your account panel. If you're running something that changes often, consider enabling more frequent snapshots or scripting your own database dumps to a separate location.

7. Use the one-click app catalog when you can

For common stacks, Byytes' one-click catalog deploys pre-hardened images (LEMP, Docker, Node, and others) with sane defaults already applied, worth checking before building an environment from scratch.

Step	Why it matters
Non-root user	Limits damage from a compromised process or mistake
SSH keys only	Eliminates brute-force password attacks
Firewall	Reduces what's reachable from the internet
fail2ban	Auto-blocks repeated intrusion attempts
Auto updates	Closes known vulnerabilities automatically