Securing a new VPS: the first 10 minutes

Log in, update, reboot

Your first SSH login is the moment to bring the system fully up to date. The image your VPS was created from is a snapshot in time, and security fixes have almost certainly landed since it was built. Apply everything before you install a single package of your own.

A reboot right after upgrading makes sure you're actually running the patched kernel and libraries, not just holding them on disk. It costs you thirty seconds now and saves you from the classic 'patched but still vulnerable' trap.

ssh root@your-ip
apt update && apt upgrade -y
reboot

Keys in, passwords out

Add your SSH public key to the server, confirm you can log in with it, and then disable password authentication entirely. Password guessing is the single most common attack a fresh VPS faces, and turning it off ends that game before it starts. Optionally, disable direct root login too.

Create a regular user with sudo rights and make it your daily driver. Working as root for everything means one typo can take the whole box down; a sudo user gives you the same power with an extra moment to think before each privileged command.

A firewall with three rules

A good starting firewall is boring: deny everything inbound by default, then open only what you actually serve. For most web servers that's exactly three rules, and anything more should have a reason attached to it.

Set the policy before you install services, not after. A port that was never reachable from the internet is a port you never have to worry about having exposed by accident.

• Allow port 22 (or your custom SSH port)
• Allow ports 80 and 443
• Deny everything else by default

Automatic security updates

Enable unattended upgrades for security patches so the operating system keeps itself current without waiting for you to remember. Critical fixes get applied within hours of release instead of during your next maintenance weekend.

This covers the OS and its packages — you still own updates for your own applications and their dependencies. Automatic patching is a safety net for the platform underneath your code, not a substitute for maintaining the code itself.

What the platform already does for you

Your Anested VPS doesn't start from zero. Network isolation keeps tenants separated from each other, and DDoS filtering at the edge absorbs volumetric attacks before they ever reach your network interface. Snapshots give you a clean restore point if something does go wrong.

Think of it as defense in depth: the platform handles the layers below your server, but the configuration inside your VPS is yours. The ten minutes you spend on this checklist are the layer only you can provide.