{"id":1842,"date":"2026-09-05T09:24:30","date_gmt":"2026-09-05T03:54:30","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-secure-linux-vps-fail2ban-ufw-ssh\/"},"modified":"2026-09-05T12:57:44","modified_gmt":"2026-09-05T07:27:44","slug":"how-to-secure-linux-vps-fail2ban-ufw-ssh","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-secure-linux-vps-fail2ban-ufw-ssh\/","title":{"rendered":"How to Secure and Harden a Linux Cloud VPS: UFW, Fail2ban & SSH Hardening Checklist"},"content":{"rendered":"

The Reality of Public Internet Scanners & Automated Attack Bots<\/h2>\n

The moment you launch a fresh Linux VPS and assign it a public IPv4 address, automated malicious botnets and vulnerability scanners begin probing your server within minutes. These automated crawlers execute tens of thousands of dictionary attacks against default SSH port 22, scan for open database ports (3306, 5432), probe for unpatched Redis instances (6379), and search for exposed web panel login portals.<\/p>\n

Leaving a production server with default root passwords or unrestricted firewall policies is an invitation to malware compromise, ransomware extortion, and botnet recruitment. By implementing a layered defense strategy comprising unprivileged sudo users, ed25519 SSH cryptographic keys, a strict UFW firewall, and automated Fail2ban intrusion prevention, you eliminate 99.9% of automated cyber threats.<\/p>\n

In this enterprise hardening guide, we will step through locking down a fresh Ubuntu 24.04\/22.04 LTS server from scratch.<\/p>\n

Step 1: Creating a Dedicated Sudo User and Disabling Root Login<\/h2>\n

Direct login as the root<\/code> superuser should always be disabled. Create a dedicated administrative user account with granular sudo<\/code> privileges:<\/p>\n

# Create a new administrative user\nadduser devadmin\n\n# Add user to sudo group\nusermod -aG sudo devadmin\n\n# Copy SSH authorized keys from root to new user\nmkdir -p \/home\/devadmin\/.ssh\ncp \/root\/.ssh\/authorized_keys \/home\/devadmin\/.ssh\/\nchown -R devadmin:devadmin \/home\/devadmin\/.ssh\nchmod 700 \/home\/devadmin\/.ssh\nchmod 600 \/home\/devadmin\/.ssh\/authorized_keys<\/code><\/pre>\n
Step 2: Cryptographic SSH Hardening (Disabling Password Authentication)<\/h2>\n
Password authentication allows brute-force dictionary bots to hammer your server continuously. Enforce cryptographic public key authentication only by editing \/etc\/ssh\/sshd_config<\/code>:<\/p>\n
# Custom SSH Port (Optional but reduces automated bot noise by 95%)\nPort 2222\n\n# Permit root login restrictions\nPermitRootLogin no\n\n# Enforce public key authentication only\nPubkeyAuthentication yes\nPasswordAuthentication no\nPermitEmptyPasswords no\n\n# Disconnect idle sessions after 10 minutes\nClientAliveInterval 300\nClientAliveCountMax 2\n\n# Disable X11 forwarding\nX11Forwarding no<\/code><\/pre>\n
Test the SSH configuration before restarting the service:<\/p>\n
# Verify syntax for errors\nsudo sshd -t\n\n# Restart SSH daemon safely\nsudo systemctl restart ssh<\/code><\/pre>\n
Step 3: Configuring UFW (Uncomplicated Firewall)<\/h2>\n
Enforce a strict default-deny inbound network policy. Allow only essential web traffic (HTTP 80, HTTPS 443) and your designated SSH port:<\/p>\n
# Set default firewall rules\nsudo ufw default deny incoming\nsudo ufw default allow outgoing\n\n# Allow SSH on your configured port (e.g. 2222 or 22)\nsudo ufw allow 2222\/tcp comment 'SSH Port'\n\n# Allow standard web server traffic\nsudo ufw allow 80\/tcp comment 'HTTP Web'\nsudo ufw allow 443\/tcp comment 'HTTPS SSL Web'\n\n# Enable firewall\nsudo ufw enable\n\n# Verify active status\nsudo ufw status verbose<\/code><\/pre>\n
Step 4: Installing and Configuring Fail2ban Intrusion Prevention<\/h2>\n
Fail2ban<\/strong> dynamically monitors server authentication log files (such as \/var\/log\/auth.log<\/code> or Nginx access logs). When an IP address fails authentication multiple times within a short window, Fail2ban automatically modifies firewall rules to ban the offending IP address for a configurable duration.<\/p>\n
# Install Fail2ban daemon\nsudo apt install -y fail2ban\n\n# Create local override configuration\nsudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
Edit \/etc\/fail2ban\/jail.local<\/code> to configure aggressive ban times:<\/p>\n
[DEFAULT]\n# Ban IP for 24 hours after repeated offenses\nbantime = 86400\n\n# Look back window of 10 minutes\nfindtime = 600\n\n# Maximum failed attempts before banning\nmaxretry = 4\n\n# Ignore local loopback\nignoreip = 127.0.0.1\/8 ::1\n\n[sshd]\nenabled = true\nport = 2222\nlogpath = %(sshd_log)s\nbackend = systemd<\/code><\/pre>\n
Restart Fail2ban and verify active jail status:<\/p>\n
sudo systemctl restart fail2ban\nsudo fail2ban-client status sshd<\/code><\/pre>\n
Step 5: Enabling Automated Unattended Security Patches<\/h2>\n
Ensure that critical Linux kernel and package CVE vulnerabilities are patched automatically without requiring manual intervention:<\/p>\n
# Install unattended upgrades package\nsudo apt install -y unattended-upgrades\n\n# Enable automated security patching\nsudo dpkg-reconfigure -plow unattended-upgrades<\/code><\/pre>\n
VPS Security Hardening Checklist Summary<\/h2>\n\n\n\n\n\n\n\n\n
Hardening Step<\/th>\nSecurity Impact<\/th>\nVerification Command<\/th>\n<\/tr>\n<\/thead>\n
Dedicated Sudo User<\/strong><\/td>\nEliminates direct root exploits<\/td>\nwhoami && groups<\/code><\/td>\n<\/tr>\n
Ed25519 SSH Keys Only<\/strong><\/td>\nStops dictionary brute-force attacks<\/td>\nssh -o PubkeyAuthentication=no user@ip<\/code><\/td>\n<\/tr>\n
UFW Firewall (Deny Inbound)<\/strong><\/td>\nBlocks unauthorized port scanning<\/td>\nsudo ufw status verbose<\/code><\/td>\n<\/tr>\n
Fail2ban Auto-Banning<\/strong><\/td>\nDynamically blacklists abusive botnets<\/td>\nsudo fail2ban-client status<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Configuring Granular Fail2ban Jails for Nginx & Bad Bots<\/h2>\n
In addition to SSH protection, you can configure Fail2ban to block web vulnerability scanners and DDoS scrapers that attempt SQL injection or probe for non-existent admin URLs (e.g., \/wp-login.php<\/code> on non-WordPress sites or \/phpmyadmin<\/code>). Edit \/etc\/fail2ban\/jail.local<\/code>:<\/p>\n
[nginx-http-auth]\nenabled = true\nport = http,https\nlogpath = \/var\/log\/nginx\/error.log\n\n[nginx-botsearch]\nenabled = true\nport = http,https\nlogpath = \/var\/log\/nginx\/access.log\nmaxretry = 3\nfindtime = 300\nbantime = 86400\n\n[nginx-limit-req]\nenabled = true\nport = http,https\nlogpath = \/var\/log\/nginx\/error.log\nfindtime = 600\nbantime = 7200<\/code><\/pre>\n
Auditing Active Listening Network Ports with ss and lsof<\/h2>\n
Perform regular network port audits to ensure no unexpected processes are listening on public interfaces:<\/p>\n
# Check all listening TCP\/UDP sockets with process names\nsudo ss -tulpn\n\n# Inspect open file handles for network sockets\nsudo lsof -i -P -n | grep LISTEN<\/code><\/pre>\n
Automated Security Alerting via Telegram \/ Discord Webhooks<\/h2>\n
Configure Fail2ban action scripts to post real-time alerts whenever a malicious IP address is banned:<\/p>\n
# Test ban action notification\nsudo fail2ban-client set sshd banip 198.51.100.1\nsudo fail2ban-client status sshd<\/code><\/pre>\n
\n
Recommended Related Technical Guides<\/h3>\n