Work through this once on every new server. It takes about ten minutes and prevents most of the tickets we see.
1. Log in and change the root password
ssh root@203.0.113.10
passwd
2. Update everything
Debian or Ubuntu:
apt update && apt full-upgrade -y
Rocky, Alma or CentOS Stream:
dnf upgrade --refresh -y
Reboot if a kernel came down with it:
[ -f /var/run/reboot-required ] && reboot
3. Create a user and add your SSH key
adduser deploy
usermod -aG sudo deploy # Debian, Ubuntu
usermod -aG wheel deploy # Rocky, Alma
From your local machine:
ssh-copy-id deploy@203.0.113.10
Then prove it works in a second terminal before going further:
ssh deploy@203.0.113.10 'sudo -v && echo ok'
4. Turn off password SSH
Only after step 3 succeeded.
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && sudo systemctl restart ssh
sshd -t checks the config first. On Rocky and Alma the unit is sshd rather
than ssh.
You cannot lock yourself out permanently
The browser console reaches the server without SSH, so a mistake here is recoverable.
5. Set the firewall
Use both the LayerOne cloud firewall and a firewall inside the server. The cloud firewall filters traffic before it reaches the guest and survives a misconfigured server. The host firewall protects services on every interface and preserves your policy if the server moves. See The cloud firewall.
A sensible starting point: inbound DROP, outbound ACCEPT, with allow rules
for TCP 22 from your address and TCP 80 and 443 from anywhere if it serves web
traffic.
6. Set the hostname and time
sudo hostnamectl set-hostname web-01.example.com
timedatectl # confirm the clock is synchronised
7. Turn on unattended security updates
Debian or Ubuntu:
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
Rocky or Alma:
sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic.timer
Then, before you go live
- Set reverse DNS if the server sends mail
- Add an external uptime monitor, so you find out before customers do. The LayerOne status page reports platform incidents; it does not monitor your application. See Monitor your VPS and configure alerts
- Arrange your own backups. We do not take any. See Backups and snapshots
- Read Harden a new server for the longer list