{"id":152,"date":"2026-06-06T09:02:00","date_gmt":"2026-06-06T09:02:00","guid":{"rendered":"https:\/\/blog.offshorekaka.in\/?p=152"},"modified":"2026-08-27T05:39:04","modified_gmt":"2026-08-27T05:39:04","slug":"secure-offshore-vps-server-checklist","status":"publish","type":"post","link":"https:\/\/offshorekaka.in\/blog\/secure-offshore-vps-server-checklist\/","title":{"rendered":"How to Secure an Offshore VPS Server: Practical Checklist"},"content":{"rendered":"
\n

Server Security<\/span><\/p>\n

The first hour on a new server<\/h2>\n

A brand new offshore VPS<\/a> starts getting probed within minutes of the IP going live. Not targeted at you, just automated scanners working through address ranges looking for port 22 with a password prompt on it.<\/p>\n

Nothing here is clever. It is five things, in order, and it takes under half an hour. Doing them in order matters, because a couple of the steps can lock you out if you do them the wrong way round.<\/p>\n

\n
Time<\/strong>About 25 minutes.<\/span><\/div>\n
Order matters<\/strong>User before SSH keys. Firewall rules before enable.<\/span><\/div>\n
Keep open<\/strong>Your current SSH session, throughout.<\/span><\/div>\n<\/div>\n<\/div>\n
On this page<\/strong>1. Patch it<\/a>2. Stop using root<\/a>3. Key-only SSH<\/a>4. Firewall<\/a>5. Fail2ban<\/a>Worth doing after<\/a>FAQ<\/a><\/div>\n

1. Patch it<\/h2>\n
apt update && apt upgrade -y<\/code><\/pre>\n
Provider images are built once and reused for months, so a fresh VPS is often behind on security updates from day one. Do this before anything else.<\/p>\n
Then turn on automatic security patching, so this does not depend on you remembering:<\/p>\n
apt install unattended-upgrades -y\ndpkg-reconfigure --priority=low unattended-upgrades<\/code><\/pre>\n
On AlmaLinux or Rocky the equivalent is dnf install dnf-automatic<\/code> followed by enabling its timer.<\/p>\n
2. Stop using root<\/h2>\n
adduser deployer\nusermod -aG sudo deployer<\/code><\/pre>\n
Two reasons this comes before the SSH work. Root is the one username every attacker already knows, so removing it as a login target removes most of their guesses. And sudo leaves a trail in the logs, so you can see what was run and when.<\/p>\n
Use usermod -aG wheel deployer<\/code> on AlmaLinux and Rocky, where the admin group is called wheel rather than sudo.<\/p>\n
Test that sudo works for the new user before moving on.<\/strong> Log in as deployer<\/code> in a second window and run sudo whoami<\/code>. If it does not print root, fix that now, while you still have a root session open.<\/p>\n
3. Key-only SSH<\/h2>\n
Now that the new user exists and can sudo, switch to keys and close password login.<\/p>\n
ssh-keygen -t ed25519\nssh-copy-id deployer@your-server-ip<\/code><\/pre>\n
\"Terminal
What you want sshd -T<\/code> to say once this step is finished.<\/figcaption><\/figure>\n
The full walkthrough, including the override file that catches most people out, is in our SSH hardening guide<\/a>. The short version is that on modern Ubuntu, a file in \/etc\/ssh\/sshd_config.d\/<\/code> can quietly re-enable password login after you have disabled it in the main config.<\/p>\n
4. Firewall<\/h2>\n
ufw default deny incoming\nufw default allow outgoing\nufw allow OpenSSH\nufw allow 80\/tcp\nufw allow 443\/tcp\nufw enable<\/code><\/pre>\n
\"UFW
Three ports open, everything else denied.<\/figcaption><\/figure>\n
The SSH line has to come before ufw enable<\/code>. There is no way around that and it is where people lock themselves out. If you moved SSH to a custom port in step 3, allow that number instead of the OpenSSH profile. More detail in the firewall guide<\/a>.<\/p>\n
5. Fail2ban<\/h2>\n
apt install fail2ban -y\nsystemctl enable --now fail2ban\nfail2ban-client status sshd<\/code><\/pre>\n
\"Fail2ban
The total failed count is a good measure of how much noise you were absorbing.<\/figcaption><\/figure>\n
With password login already off, fail2ban has less to do, but it still cuts off the slow scanners that keep knocking. It also works on web logs, so you can use it against WordPress login attempts later.<\/p>\n
Worth doing after the first hour<\/h2>\n