Securing Linux from Day Zero
Within minutes of provisioning a public IPv4 address, automated scanners begin probing port 22 for weak credentials. Here is our recommended hardening checklist for every production Linux VPS instance.1. Disable Root Password Login & Enforce Ed25519 SSH Keys
Ed25519 provides superior elliptic curve cryptographic security with high resistance to side-channel attacks compared to legacy RSA:# On your local machine:
ssh-keygen -t ed25519 -C "admin@yourcompany.com"
# Copy to server:
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@your-server-ip
Then edit /etc/ssh/sshd_config:
PermitRootLogin prohibit-password
PasswordAuthentication no
X11Forwarding no
MaxAuthTries 3
2. Configure Uncomplicated Firewall (UFW)
Only expose the exact services you need:sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment "SSH"
sudo ufw allow 80/tcp comment "HTTP"
sudo ufw allow 443/tcp comment "HTTPS"
sudo ufw enable
3. Kernel TCP/IP sysctl Hardening
Add the following to/etc/sysctl.d/99-security.conf:
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
Apply with sudo sysctl --system.
For full peace of mind, our Managed Infrastructure team applies automated hardening, 24/7 port monitoring, and proactive patch management.