You just spun up a new VPS on DigitalOcean, Hetzner, or AWS. The clock is ticking — bots are already scanning for open servers. Here's how to lock it down in 10 minutes.
Step 1: Connect and Update
SSH into your server as root (the only time you should use root):
ssh root@your-server-ip
Update everything immediately:
apt update && apt upgrade -y
Step 2: Create a Non-Root User
Never work as root. Create a new user:
adduser deploy
usermod -aG sudo deploy
This gives your new user sudo access when needed.
Step 3: Set Up SSH Key Authentication
On your Mac, copy your public key to the server:
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@your-server-ip
Test that it works:
ssh deploy@your-server-ip
You should log in without a password.
Step 4: Disable Root Login & Password Auth
Edit the SSH config on the server:
sudo nano /etc/ssh/sshd_config
Change these settings:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
UsePAM no
Restart SSH:
sudo systemctl restart sshd
Important: Test your key login in a new terminal window before closing your current session. If something is wrong, you can still fix it.
Step 5: Set Up a Firewall (UFW)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
Check status:
sudo ufw status verbose
Only SSH (22), HTTP (80), and HTTPS (443) are open. Everything else is blocked.
Step 6: Change the Default SSH Port (Optional)
Moving SSH off port 22 eliminates 99% of automated attacks:
sudo nano /etc/ssh/sshd_config
Port 2222
Update your firewall:
sudo ufw allow 2222/tcp
sudo ufw delete allow ssh
sudo systemctl restart sshd
Update your local SSH config on your Mac:
Host myserver
HostName your-server-ip
User deploy
Port 2222
Step 7: Install fail2ban
fail2ban automatically bans IPs that fail login attempts:
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
The default config bans an IP for 10 minutes after 5 failed attempts. You can customize this in /etc/fail2ban/jail.local.
Step 8: Enable Automatic Security Updates
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades
This automatically installs security patches. Your server stays protected even when you forget to update.
Step 9: Set Up Swap (If Needed)
Cheap VPS plans often have limited RAM. Add swap:
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
The Security Checklist
- Non-root user with sudo access
- SSH key authentication only (no passwords)
- Root login disabled
- Firewall configured (only necessary ports open)
- fail2ban installed
- Automatic security updates enabled
- SSH port changed (optional but recommended)
Managing Your Servers
Once you have multiple servers, managing them gets complex fast. You need to track IPs, ports, keys, and credentials for each one.
A connection manager helps. Pluto Door stores all your server connections in one place, with credentials encrypted in macOS Keychain. One click to connect, and you're in — with a terminal, file browser, and editor ready to go.
Whatever tool you use, the important thing is that your servers are locked down from minute one. These 10 minutes of setup prevent real problems down the road.