VPS: Linux Security Tips

Learn how to improve the security of your Linux server with essential tips to prevent unauthorized access and protect your services → Find out more

10 November 202611 min read0 Views0 helpful

Introduction

This guide includes tips and advice on how to make your Linux server more secure. Since VPSs need to be accessible from outside, basic protection against unwanted access is definitely recommended and should not be neglected.

Info

Please note that these instructions are not exhaustive. You can find more detailed information in other areas of the ZAP documentation (e.g., 2FA (SSH))

Tip

The easiest way to protect your server is always the same, regardless of the server: use secure passwords, update your services regularly, and generally be careful about which services you install and which instructions you follow.

Securing SSH

SSH (Secure Shell) is a service that lets you access your server's console remotely to run commands. Here's how to set up SSH on your server: First access (SSH)

By default, SSH uses password-based login. However, this has a major drawback: authentication can be bypassed relatively easily through brute-force attacks, especially if you use a password that's too simple for your SSH login. So, if you choose the password option, please use a secure password.

To better protect your server against unwanted SSH access, you should enable authentication exclusively via SSH keys and disable password login. See the SSH key guide, which explains how to generate and add SSH keys.

Configuring service ports

Service	Port
SSH	22
FTP	21
Mail	25
DNS	53
HTTP	80
HTTPS	443

Services such as SSH or FTP always use the same default ports (some of these are listed in the table above). If an external attacker tries to brute-force your SSH service, they first need to know which port SSH uses. If you don't configure these ports differently, ports 22 and 21 are usually the first ones an attacker will try to execute commands directly on the server or access files via FTP.

To prevent this, we recommend assigning custom ports to standard services. Find out how in the next section:

Warning

Your chosen port must be between 1024 and 65535 and must not already be in use!

Use cat /etc/services to view some standard ports so you don't choose one that's already occupied.

SSH port

To change the SSH port, you need to edit the configuration file. It is usually located at /etc/ssh/sshd_config. If it isn't, you can find it with the following command:

Code

find / -name "sshd_config" 2>/dev/null

Now open the file with nano (as root or using sudo).

Code

sudo nano /etc/ssh/sshd_config

Enter your chosen port after Port. If Port is commented out (that is, #Port 22), remove the "#" and replace 22 with your chosen port. Save the file (in Nano, press Ctrl + o) and close it (in Nano, press Ctrl + x).

You now need to restart the SSH service for the changes to take effect.

Code

# Unter Ubuntu/Debian/CentOS z.B.
sudo systemctl restart sshd

FTP port

If you have installed an FTP service such as proFTPd, you can also easily change its port by editing the configuration file. The process is similar to changing the SSH service's port.

Find the configuration file proftpd.conf

Code

find / -name "proftpd.conf" 2>/dev/null

The file is usually located at /etc/proftpd.conf (CentOS) or /etc/proftpd/proftpd.conf (Ubuntu, Debian). Open the file with nano, remove the "#" before port, and enter your chosen port after it. Follow the notes above to make sure you don't enter an invalid port.

Tip

Use Ctrl + W to search in nano.

Code

nano /etc/proftpd/proftpd.conf

Using a firewall

The principle of making a server accessible from outside is always the same: a port must be open for the server to be reachable. For SSH, this is by default port 22/TCP. (See above for how to change the default port.)

The problem is that this port is now accessible to everyone, regardless of who they are, where they're connecting from, or what their intentions are. This creates a major security vulnerability, since attackers could flood the server with login attempts to guess the correct password (using brute force, if password login is still enabled) or cripple the server network by overloading it (e.g., with a DDoS attack).

To reduce these risks, you can use firewall rules to restrict access to open ports.

There are two methods you can use:

IPTables: The classic Linux firewall with many options, but it's a little more complex to use.
UFW: A simpler interface for IPTables that avoids complicated commands but is somewhat more limited.

Ultimately, it's up to you which method you want to use. Depending on your use case, you may need the flexibility of IPTables, but sometimes UFW is enough (e.g., if you simply want to open or close ports—better than nothing!).

IPTables

In this section, you'll use IPTables to create rules that limit the number of connection attempts. Explanations of the individual commands are provided below the code block.

Note that this rule is only enabled for port 22 (the value after --dport). You would need to adjust the commands for other services.

Info

The following commands do not work on every Linux distribution, but they work on most of the most popular distros.

First, log in to your Linux server. If you need help, follow our First access (SSH) guide. Then run the following commands in the order shown.

Code

iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 2 --connlimit-mask 32 -j DROP
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

The first rule drops packets if there are more than 2 connections in the TIME_WAIT state to port 22 from a single IP address.
The second rule adds the IP address of a new connection to the recent list.
The third rule drops new connections from IP addresses that have made more than 2 connection attempts in the last second.

UFW

As described above, UFW is a "simpler" interface for IPTables. The first step is to install UFW, since it isn't included by default in all Linux distributions. You should run the commands as root or using sudo.

First, log in to your Linux server. If you need help, follow our First access (SSH) guide. The following instructions have been tested with Debian and Ubuntu, but should also work with other Linux distributions.

First, update the apt package index and existing services.

Code

sudo apt update && sudo apt upgrade -y

Then install UFW via apt.

Code

sudo apt install ufw -y

Make sure the installation was successful by running the following command.

Code

sudo ufw status
> Firewall not loaded

To avoid locking yourself out of your server, you must allow the SSH service before enabling the firewall.

Warning

If you have already changed the SSH port, enter the new port here instead of 22.

Use the following commands to allow the SSH service.

Code

sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status

A successful output should look like this:

Code

Status: active
  
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)

Now run the following command to limit connections to 6 per minute.

Code

ufw limit 22/tcp

Info

UFW only allows you to limit connections to 6 per minute. The UFW rate limiter is quite simple and isn't suitable for every situation. For a more detailed and flexible configuration, we recommend using IPTables directly.

Tip

The firewall (whether IPTables or UFW) blindly counts connection attempts and blocks them accordingly. With Fail2Ban, you can check log files for suspicious activity. Find out how to install and enable Fail2Ban in the next section.

Additional protection with Fail2Ban

Fail2Ban is a service that blocks IP addresses that try to log in to your server with likely malicious intent. Fail2Ban monitors log files for suspicious activity, making it a relatively easy and effective way to secure your system.

After installation, Fail2Ban includes preconfigured settings for some commonly used services, including:

apache
lighttpd
sshd
qmail
postfix
Courier Mail Server You can easily add other services by specifying a regular expression (RegEx) and the log file you want to monitor.

As an example, let's look at an entry in /var/log/auth.log. This file contains all SSH login attempts, whether successful or failed.

Here's the entry:

Code

Dec 2 12:59:19 vps-zap515723-2 sshd[364126]: Failed password for root from 92.117.xxx.xxx port 52504 ssh2

Fail2Ban uses this log file and monitors it for failed authentication attempts. Since the log file includes the attacker's IP address, Fail2Ban can block that IP address after a number of failed attempts.

Installing Fail2Ban

First, log in to your Linux server. If you need help, follow our First access (SSH) guide. You should run the commands as root or using sudo.

Code

sudo apt update && sudo apt upgrade -y
sudo apt install fail2ban

After installation, you can check the status directly with systemctl. (Press Ctrl+C to exit systemctl.)

Code

systemctl status fail2ban.service
* fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor pres>
     Active: active (running) since Sat 2023-12-02 13:10:33 UTC; 24s ago
       Docs: man:fail2ban(1)
    Process: 23988 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, statu>
   Main PID: 23989 (fail2ban-server)
        CPU: 409ms
     CGroup: /system.slice/fail2ban.service
             `-23989 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

Dec 02 13:10:33 vps-zap515723-1 systemd[1]: Starting Fail2Ban Service...
Dec 02 13:10:33 vps-zap515723-1 systemd[1]: Started Fail2Ban Service.
Dec 02 13:10:34 vps-zap515723-1 fail2ban-server[23989]: Server ready

Configuring Fail2Ban

Fail2Ban is now installed, but it isn't active or configured yet. Check /etc/fail2ban; the following files should be there:

Code

action.d fail2ban.d jail.conf paths-arch.conf paths-debian.conf
fail2ban.conf filter.d jail.d paths-common.conf paths-opensuse.conf

To create an active "jail", you need to create a file named jail.local. Simply copy the contents of jail.conf into the new file and open it:

Code

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

You can now configure all settings in the jail.local file, including which services to monitor. You should focus only on the section after [Default]. The Default section contains general basic settings.

Scroll down until you find this section, and adjust it, for example, as follows:

Attribute	Description	Value
ignoreip	IP addresses that should not be blocked	127.0.0.1/8
ignorecommand	Not relevant.
bantime	How long an IP address remains blocked	1h
findtime	Period during which failed logins are counted	10m
maxretry	Number of failed attempts that result in a ban	5

Code

# kann mit Leerzeichen (und/oder Komma) getrennt definiert werden.
#ignoreip = 127.0.0.1/8 ::1

# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" ist die Anzahl der Sekunden, die ein Host gesperrt ist.
bantime  = 1h

# Ein Host wird gesperrt, wenn er "maxretry" Fehler innerhalb von "findtime"
# Sekunden erzeugt hat.
findtime  = 10m

# "maxretry" ist die Anzahl der Fehler, bevor ein Host gesperrt wird.
maxretry = 5

You've now completed the basic settings. To monitor the SSH service, for example, scroll down to the [sshd] tag. If you changed your port, enter it under port.

The [sshd] section should then look like this:

Code

[sshd]

enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 4

Tip

As you can see, you can also set individual options for specific services (for example, maxretry is lower than the default setting here). Even though you've set general options earlier, you can configure most settings separately for each service. If you don't, the general setting will be used.

Now you only need to restart Fail2Ban to start monitoring.

Code

sudo systemctl restart fail2ban.service

Checking that Fail2Ban works

If you have access to a VPN or a second server, you can test whether the service works by trying to get Fail2Ban to block you. Using a VPN or your phone's hotspot should give you a different IP address to test Fail2Ban with.

Warning

Don't test this on your regular network, as your own IP address could be blocked and you could lock yourself out.

Try connecting to your server via SSH (using a different IP address!) and enter the wrong password each time. The result should look something like this:

Code

root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
root@185.223.29.xxx: Permission denied (publickey,password).
root@vps-zap515723-2:/var/log# ssh root@185.223.29.179
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
Permission denied, please try again.
root@185.223.29.xxx's password:
^C
root@vps-zap515723-2:/var/log# ssh root@185.223.29.xxx
ssh: connect to host 185.223.29.xxx port 22: Connection refused

As you can see, the connection to your Fail2Ban-protected server is now refused (Connection refused instead of Permission denied).

Now display the Fail2Ban status. You'll see that an IP address has been blocked.

Code

fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 4
|  |- Total failed:     8
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   xxx

If you want to unblock the IP again, you can do so with the following command: fail2ban-client set sshd unbanip {deine IP}.

Info

If you have an unusually high number of blocked IPs, we recommend increasing the ban time with each failed attempt to reduce the number of possible login attempts.

Code

[sshd]

enabled = true
port    = 22
filter  = sshd
logpath = /var/log/auth.log
maxretry = 4

bantime = 1h
# Bantime sollte mit jeder Sperre dieser IP steigen
bantime.increment = true
# Skalierungsfaktor von 24 Stunden (1h,24h,48h,3d,4d....)
bantime.factor = 24
# Maximale Sperrzeit = 5 Wochen
bantime.maxtime = 5w

Protecting your web server with Cloudflare

Many people use Cloudflare as the DNS manager for their domain. Cloudflare not only has one of the largest networks in the world, resulting in faster loading times, lower latency, and a better user experience, but also protects your websites against DoS/DDoS attacks, including flooding and new types of attacks discovered every day. In this guide, you'll learn how to protect your web server from attacks.

We'll assume that your domain is already managed by Cloudflare. If it isn't, you can follow their guide to transfer your domain. In the Cloudflare dashboard, go to the DNS Records tab and make sure the record pointing to your web server has the orange cloud and shows "Proxied".

All traffic going through your domain will then pass through Cloudflare and on to your server—legitimate traffic. However, your server will still be accessible from outside Cloudflare. To prevent this, you need to restrict access to ports 80 and 443 of the TCP protocol on your Linux server and allow access only when traffic comes from legitimate Cloudflare IPs.

You can do this manually by creating firewall rules using Cloudflare's public IPv4 list and Cloudflare's public IPv6 list.

Alternatively, save time by using tools such as Cloudflare-ufw to quickly import these firewall rules in bulk. Make sure you don't have any separate rules that allow unrestricted access to your web server, apart from the rules you just added; otherwise, the rules won't work.

Conclusion – your server is now much more secure!

This guide has shown you some basic and advanced features for securing your Linux server. If you've followed all the recommendations that apply to your system, your server is already much more secure than before—congratulations!

There are, of course, other measures you can take:

2FA (SSH)
Add more Fail2Ban configurations
Set up email notifications in Fail2Ban
And much more...

FAQ

Frequently asked questions

Use secure passwords, update services regularly, and be careful about which services you install and which instructions you follow.

Enable authentication exclusively via SSH keys and disable password login. See the SSH key guide for details.

Port 22. Attackers trying to brute-force SSH first need to know which port it uses.

Feedback

Was this article helpful?

Your feedback helps us prioritize and improve content.

0 of 0 Users found this article helpful.

Personal support

Need more help than the guide provides?

Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.

Which 🍪 cookies would you like to allow?

VPS: Linux Security Tips

Introduction

Securing SSH

Configuring service ports

SSH port

FTP port

Using a firewall

IPTables

UFW

Additional protection with Fail2Ban

Installing Fail2Ban

Configuring Fail2Ban

Checking that Fail2Ban works

Protecting your web server with Cloudflare

Conclusion – your server is now much more secure!

Frequently asked questions

VPS

Securing SSH

Using a firewall

IPTables

UFW

Protecting your web server with Cloudflare

Conclusion – your server is now much more secure!

Game Server

Servers & Hosting

ZAPX

Resources

ZAP-Hosting