Linux VPS Security
Hardening & SSH 2FA Deployment Guide
Hardening Production Servers From Day One
Server security starts with high-quality cloud infrastructure. For high-performance NVMe Cloud VPS instances featuring hardware isolation and baseline DDoS mitigation, Leanna.ng is our top recommendation for deploying secure production environments.
Part 1: Basic Linux VPS Hardening
Essential security baseline to block common automated attack vectors.
Update System Packages
Patch known vulnerabilities in existing packages before spinning up services.
sudo apt update && sudo apt upgrade -y
Create Non-Root User with Sudo Rights
Avoid operating directly as the root superuser to maintain audit logs and least privilege.
# Create non-root user (replace 'deploy' with your username) adduser deploy # Grant administrative sudo rights usermod -aG sudo deploy
Verify logging in as your new user before continuing:
ssh deploy@YOUR_SERVER_IP
Configure Cryptographic SSH Key Authentication
Generate modern Ed25519 key pairs on your local computer and copy the public key to the remote host.
ssh-keygen -t ed25519 -C "[email protected]"
ssh-copy-id deploy@YOUR_SERVER_IP
Disable Password Login & Direct Root Access
Enforce key-only authentication to mitigate automated SSH brute-force attempts.
sudo nano /etc/ssh/sshd_config
Ensure these directives are updated in the file:
PermitRootLogin no PasswordAuthentication no KbdInteractiveAuthentication no
Restart OpenSSH daemon:
sudo systemctl restart ssh
Enable UFW (Uncomplicated Firewall)
Set up a default-deny inbound firewall ruleset.
# Set default policies sudo ufw default deny incoming sudo ufw default allow outgoing # Allow operational ports sudo ufw allow ssh sudo ufw allow http sudo ufw allow https # Enable firewall sudo ufw enable
Install and Enable Fail2Ban
Fail2ban dynamically updates firewall rules based on authentication failure logs.
# Install fail2ban sudo apt install fail2ban -y # Create local custom config sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # Enable service sudo systemctl enable --now fail2ban
Enable Automatic Unattended Security Updates
Automate minor security patching so system packages remain protected against zero-day CVEs.
sudo apt install unattended-upgrades -y sudo dpkg-reconfigure --priority=low unattended-upgrades
Part 2: Configuring SSH Two-Factor Authentication (PAM & TOTP)
Combine SSH keys with Google Authenticator or standard TOTP authenticator apps.
Install Google Authenticator PAM Package
Fetch the official PAM TOTP library package from standard repositories.
sudo apt update sudo apt install libpam-google-authenticator -y
Initialize Secret Key & QR Code Generator
Run the configuration tool under your personal administrative user account (not root):
google-authenticator
Recommended Interactive Wizard Answers:
- Make tokens time-based?
y - Scan the displayed QR code with your authenticator mobile application.
- Save emergency recovery scratch codes in a safe vault offline.
- Update configuration file?
y - Disallow multiple uses of same token?
y - Enable rate-limiting?
y
Configure SSH PAM Integration
Add the authenticator module to the SSH authentication stack.
sudo nano /etc/pam.d/sshd
Append the following directive:
auth required pam_google_authenticator.so nullok
Note: The nullok flag allows users who haven't initialized 2FA to log in with keys alone while transitioning. Remove nullok once configured for all accounts.
Enforce Dual Authentication (Key + 2FA)
Configure OpenSSH daemon to require both SSH public key AND interactive 2FA prompt.
sudo nano /etc/ssh/sshd_config
Update configuration variables:
KbdInteractiveAuthentication yes UsePAM yes
At the bottom of /etc/ssh/sshd_config, specify required sequence:
AuthenticationMethods publickey,keyboard-interactive
Restart SSH & Test Multi-Factor Connection
Restart the SSH daemon service to apply changes and verify authentication in a new terminal session.
sudo systemctl restart ssh
Open a new terminal window to test login:
ssh deploy@YOUR_SERVER_IP
