In short: Secure a new Linux VPS before putting customer data or a public application on it. Patch the operating system, create accountable administrator access, verify SSH keys, restrict network exposure, configure backups and monitoring, and keep console access available for recovery.
1. Update the operating system
Install current security updates using the package manager for your chosen distribution. Reboot if the kernel or another critical component requires it, then confirm that the expected services return.
2. Create safe administrator access
- Create a named user for each administrator rather than sharing one login.
- Grant elevated access through
sudoonly where required. - Use a unique SSH key for each person or automation.
- Remove access promptly when it is no longer needed.
3. Limit network exposure
Enable a host firewall and permit only services the server actually provides. Bind administration panels and databases to private or restricted interfaces where possible. If SSH must be public, restrict source addresses where practical and monitor authentication attempts.
4. Harden the workload
- Run applications as unprivileged service accounts.
- Remove sample applications, default credentials and unused packages.
- Keep application runtimes and dependencies supported and patched.
- Store secrets outside the web root and restrict file permissions.
- Use TLS for public services and renew certificates automatically.
5. Back up and monitor
Maintain backups separate from the VPS and test that they can be restored. Monitor availability, storage, memory, certificate expiry and backup success. Configure log retention and alerts before the service becomes important.
Ongoing maintenance
- Review security updates on a defined schedule.
- Rotate exposed or shared credentials.
- Audit administrator accounts and open ports.
- Test recovery after material application or infrastructure changes.
