A fresh VPS is scanned and probed within minutes of coming online. The good news: an hour of ordered hardening stops the overwhelming majority of opportunistic attacks. This is the checklist, in the order that matters, for a new privacy-focused server.
1. Lock down SSH first
Create a non-root user with sudo, add your public key, and then disable password authentication and root login in sshd_config (PasswordAuthentication no, PermitRootLogin no). Keys-only SSH alone defeats the password-guessing that makes up most of the noise hitting your server. Restart SSH and confirm a new session works before closing your current one.
2. Put a firewall in front
Default-deny inbound, allow only what you need. With ufw: deny incoming, allow outgoing, then allow your SSH port and the specific service ports you run. A firewall turns "every open port is a target" into "only the doors you chose exist," which shrinks the attack surface dramatically.
3. Add fail2ban
Install fail2ban to watch auth logs and temporarily ban IPs that fail repeatedly. Even with keys-only SSH, it cuts log noise and blunts brute-force attempts against any service you expose. The defaults are sensible; enable the sshd jail and any jails for services you run.
4. Turn on automatic security updates
Enable unattended-upgrades (Debian/Ubuntu) so security patches land without you remembering. The single most common way servers are compromised is a known vulnerability that had a patch available — automating updates closes that window while you sleep.
5. Reduce the attack surface
Uninstall services you do not use, bind local-only daemons to 127.0.0.1, and check what is listening with ss -tlnp. Every listening service is a potential entry point; the fewer you run and expose, the less there is to attack. Then set up off-box backups so a compromise is recoverable, not catastrophic.
The hour, summarised
Keys-only SSH, a default-deny firewall, fail2ban, automatic updates, and a minimal listening surface. None of it is exotic, all of it is fast, and together it stops the automated attacks that account for nearly all real-world compromises. Do it before you deploy anything that matters.