VPSs (Virtual Private Servers) are much more popular nowadays than a decade ago. That's probably due to factors such as the evolution of the IT industry and its professionals, the search for optimized and cheaper solutions, and the popularization of new technologies as alternatives to the standard LAMP stack (specifically Apache, MySQL, and PHP), ubiquitous on shared hosting environments.

What is a VPS?

A VPS (Virtual Private Server) is a private (only you have access) virtual machine sold as a service by an Internet hosting service. ("Virtual Private Server - Wikipedia")

A VPS hosting service is a hosting service sitting between a shared and a didicated server hosting. It mimics a dedicated server because you have your own OS (Operating System) instance, which allows you to do anything you want at a software level. But simultaneously, your VPS shares hardware (CPU, RAM, I/O operations, etc.) with other VPSs running in the same physical machine. Depending on the hosting service and virtualization technique, you have more or less a guarantee for dedicated resources. For example, RAM is usually dedicated to you, but I/O operations are shared among VPSs. Because of that, VPSs have become much more popular nowadays. Its only drawback is the effort necessary to set up all the software you need, starting with your OS, Linux distribution usually, and the subsequent maintenance that it requires, e.g., Linux distro updates are not mandatory but good practice, alongside upgrading other software packages like web servers that the system will be running. Hopefully, that's easier than you might think, and this article will help you in this first step.So, let's do it!

Step 1. Choosing a hosting service and installing a Linux distro

Choosing a hosting service may be challenging, but a little research will give you a good idea about some good and cheap companies. You should prefer those that bill hourly, so you'll pay very little if you use few resources. Next, find out what Linux distros and versions they provide. Always use the latest version of the OS you choose. Finally, you should be able to install your Linux distro through some control panel web app provided by the hosting company, which after installing your distro, should send you an email with the password for your Linux root user and the IP address of your VPS so that you can connect to it through SSH.

I'll use Debian 11 and a macOS as my local machine for this tutorial. Since Ubuntu (and Ubuntu Server) are built on top of Debian, both are virtually the same for server purposes.

Step 2. Connecting to your VPS through SSH

macOS comes with an SSH client by default, so you don't need to install one yourself. But if you're running Windows on your local machine, you must install one. PuTTY is the most popular, but choose whatever you want.

To connect to your VPS, you run a command using the following format:

For example:

If you get a question like this:

Just type "yes" and press Enter.

When it prompts for the password, type the root password you got by email. Now you should be connected into your Linux server. Congrats!

Step 3. Updating your Linux distro

The first thing you should do after a fresh Linux install is to update the system itself and its core packages. Some packages might need to be updated. To do that, you first update the definitions of your Linux distro packages and then upgrade them all:

If you get the question:

Just type "Y" and press Enter. You should probably see a bunch of updates. Cool, now you're fresh! You can and should run those two commands occasionally to keep your Linux distro updated and more secure.

Step 4. Setting the Hostname and FQDN

Now you'll set your system's hostname and FQDN (fully qualified domain name). Don't worry about this, it's just a name for your Linux machine, and it doesn't directly relate to what you'll host. But make it a unique name (also, do not use the same name for other Linux users).

Just replace flsilva-debian by any simple, lowercase name you want. You can verify it by running:

You should see an output with the name you typed.

Now, if you run a command like the following:

You should see instructions about how to use the command, but the first line of the output should be something like this:

That's beucase we haven't set our FQDN yet. So let's edit /etc/hosts file and add an entry with your FQDN (your system's hostname + your system's domain name).

The domain name doesn't have any relationship to what you're going to host either. Just make sure the first two lines of your /etc/hosts file looks the same as the following (replacing flsilva-debian by your hostname, website.com by your new domain name, and 123.456.78.90 by your VPS' IP address):

Save the changes by hitting Control-X, then Y, and then Enter.

Now, if you run $ sudo again you shouldn't see that message again.

Step 5. Setting up the timezone

You can change the timezone of your Linux server. You can set the timezone if your website or application is local to a city or country. If you're dealing with users from several countries or want more flexibility, you can set the timezone to UTC. Then, when you retrieve or show time-related data to your users, you can translate time from UTC to your users' local timezone.

You can run $ date to check what's the time in your server. You can use a simple tool to change the timezone running:

You should see a simple menu to select a geographic area, and then a timezone.

Tip: UTC is inside the Etc option.

Step 6. Creating a firewall

Now it's time to start securing your server. A basic firewall will limit what ports your server allow traffic, blocking all unecessary ones. Linux provides iptables (for IPv4 rules) and ip6tables (for IPv6 rules) tools that allow us to define rules that take care of what to do with net packets.

First, let's check our current rules:

Since we haven't changed anything yet, you should see an empty ruleset:

The same output should be shown for ip6tables rules:

Now you'll create a new file that will host all your custom rules (for IPv4 and IPv6, in the same file):

You'll allow traffic only to the following services: HTTP (80), HTTPS (443), SSH (22), and ping. All other ports will be blocked. If you have different needs, feel free to change the rules. There are also some other security rules, like preventing SSH brute-force attacks, preventing ping flooding, etc., that you should look at. The following rules were copied from this GitHub Gist (rules-both.iptables) on May 06th, 2014, and only modified to uncomment two lines that allow HTTP and HTTPS (on part 2 HOST SPECIFIC RULES):

Paste the exact content below to your rules-both.iptables file:

Save the changes by hitting Control-X, then Y, and then Enter.

Now you'll activate the firewall rules. Run the following commands:

Now if you check your rules again you should see lots of things:

Now you'll create a new script that will automatically activate the rules everytime the server is restarted. First create a new file:

Copy and paste the following lines in to the file:

Save the changes by hitting Control-X, then Y, and then Enter.

Now change the script's permissions:

Great! Now, when you restart your server your rules will be active!

Step 7. Install Fail2ban

Fail2ban is a tool to protect servers from single source brute force attacks. It bans IPs that show malicious signs, like too many password failures.

Install Fail2ban:

That's it! Now Fail2ban is protecting your server. It'll log its activities at /var/log/fail2ban.log.

Step 8. Adding a new user

Another great way to secure your server is by stopping using the root user because it's too powerful. It's best practice to create different users with only the necessary permissions for specific tasks. For example, a deploy user used to deploy websites.

To create a new user run the following command:

After running the command above, you should type a new password for that new user. deploy is a common username for a user that deploys websites and apps. But you can create any number of users with any names you want.

Now, if you're going to create a new user to virtually replace the root superuser, which is recommended, it's useful to add that new user to the admin group, so you can run superuser commands when needed by prefacing them with the sudo keyword (all commands executed with sudo are logged to /var/log/auth.log).

Step 9. Stop using the root user

Now, let's log out and in again, but this time using our new user:

After logging in you should see something like this in your command line tool:

Where deploy is the user you've logged in, and flsilva-debian is your system's hostname. Now your server is a little less exposed.

Step 10. Using SSH key pair authentication

Now, you should start using SSH key pair authentication, disabling password authentication entirely.

That's a more secure way to log in, as it protects you against brute-force password attacks and provides other advantages.

If you're on a Mac and need to generate SSH keys or need clarification, head to my guide on How to generate and use SSH keys on macOS.

In that case, you'll generate a public and private key pair on your local machine. So first, log out from your server:

Then, go ahead and follow that step-by-step guide, then come back here to proceed.

Now that you have your SSH keys, let's upload your public key to your server using the security copy command ($ scp). For Windows you can use WinSCP.

Change the file name and path if necessary.

Don't forget the : character at the end of the command! 😉

Now, let's log into your server still using a password and move the file to the appropriate directory:

Now let's modify the permissions of the .ssh directory and the public key file (replace deploy with your username):

Now you're ready to test your key pair authentication. Let's log out and in again. You should not be prompted for your password, but if you've specified a passphrase you'll have to enter it.

Congratulations! You now have SSH key pair authentication working!

Now, you still need to disable password authentication to make your server even more secure. So let's do that!

Step 11. Disabling SSH password authentication and root login

Open the SSH configuration file:

Look for the following two lines, and make sure to change their values to no and remove the # character in front of the lines, if there's one (it means that the line is commented out, so not effective):

Save the changes by hitting Control-X, then Y, and then Enter.

Now you need to restart the SSH service to use the new configuration:

Now let's test it. Log out and then try to log in as root user:

You should not be asked for a password, and should get a message like the following:

Awesome! You have now secured a little more your server.

Now you have a basic server up and running securely! How cool is that? But remember, security is never enough. It's always possible to set up and install additional tools. But for a basic server, that's a nice setup.

Let me know if you need any help with this step-by-step tutorial. Something may be missing, or even using different versions of Debian, Ubuntu, or other packages.

Happy sysadmin! 🙃

Related posts

How to install Nginx on Linux
How to set up a website on Linux + Nginx
How to password-protect content on Linux + Nginx
Wildcard HTTPS on Linux + Let's Encrypt + Nginx
What are HTTPS, TLS certificates, and Let's Encrypt?

Interesting links

SSH (Secure Shell)
iptables
Fail2ban

Bibliography

"Virtual Private Server - Wikipedia" Wikipedia , n.d. Web. 06 May 2014 <http://en.wikipedia.org/wiki/Virtual_private_server>