Complete VPS Security Checklist

Command of the Day

last -n 20

What it does: Displays a list of the 20 most recent user login sessions, including remote IP addresses, login times, and session durations.

Deploying a Linux VPS to the public Internet exposes it to continuous automated brute-force attacks, port scanners, and exploit scripts within minutes of provisioning. Leaving a server in its default unhardened configuration is a severe security risk.

In this guide, we provide a complete, actionable security checklist to harden your RivinCloud Linux VPS against unauthorized access and security breaches.

1. The 10-Point Security Hardening Checklist

[✓] 1. Create a Sudo Non-Root User
[✓] 2. Configure SSH Key Authentication (Ed25519)
[✓] 3. Disable Password Authentication & Root Login in OpenSSH
[✓] 4. Change Default SSH Port (e.g., to 2222)
[✓] 5. Enable UFW Host Firewall (Default Deny Incoming)
[✓] 6. Install and Configure Fail2Ban
[✓] 7. Enable Unattended Security Updates
[✓] 8. Set File Permissions on Sensitive Directories
[✓] 9. Secure Shared Memory (/tmp and /var/tmp)
[✓] 10. Audit Active Listening Ports and Login Logs

2. Step-by-Step Security Implementation

1. Disable Password Auth and Direct Root SSH

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
Port 2222

Test syntax and restart SSH:

sudo sshd -t
sudo systemctl restart sshd

2. Configure UFW Firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp  # Your custom SSH port
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

3. Install Fail2Ban Intrusion Prevention

sudo apt update && sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl restart fail2ban

Command of the Day: `last`

The last command searches backward through the /var/log/wtmp file to display a clean historical log of all user logins, logouts, and system reboots.

Syntax

last [options] [username]

Practical Example

# View the last 15 successful login sessions
last -n 15

Sample Output

ubuntu   pts/0        203.0.113.45     Mon Sep 28 14:20   still logged in
ubuntu   pts/0        203.0.113.45     Sun Sep 27 09:12 - 11:45  (02:32)
reboot   system boot  5.15.0-101-generic Sun Sep 27 09:10   still running

Explanation

Inspecting last output regularly helps system administrators confirm that logins originate strictly from trusted IP addresses.

To check for failed brute-force login attempts recorded on your server:

# View recent failed login attempts
sudo lastb -n 20

# Check failed SSH attempts in systemd journal
sudo journalctl -u sshd | grep "Failed password" | tail -n 20

Common Mistakes

Disabling password authentication before verifying SSH key access: Always keep your active SSH session open while testing key authentication in a separate terminal window.
Neglecting package security updates: Leaving unpatched software vulnerable to known CVE exploits.

Troubleshooting

Locked out of your VPS? Use RivinCloud's Web VNC out-of-band console in your client dashboard to log in locally and disable UFW (sudo ufw disable) or restore SSH passwords.

Best Practices

Enable automatic security updates using unattended-upgrades.
Keep open ports minimal—only expose ports required for active services.

Frequently Asked Questions

Is changing the SSH port sufficient to secure a server?

No. Changing the SSH port reduces automated log noise, but it is security through obscurity. It MUST be combined with SSH key authentication and firewall rules.

Conclusion

Following this security checklist ensures your RivinCloud VPS remains hardened against cyber threats. Implement these security controls today!