The vast majority of our Linux servers (VPS or Dedicated Servers) are delivered "bare", meaning with a configuration very similar to what you would have had if you had installed the OS yourself.

By default, this configuration does not include any elements intended to ensure the security of the server. It is therefore strongly recommended to follow these few simple rules in order to strengthen the security of your VPS.

This article will deliberately focus on protecting the root access of your VPS (which is the most vulnerable upon delivery, and the most frequently attacked). Other aspects of your VPS's security can also be explored (setting up a firewall, regular OS updates, regular log analysis, backups, etc).

1/ Strengthen your root password#

Upon delivery, if you did not set it yourself, your VPS is created with a random 6-character root password, to make your first access to your VPS easier. Although random, this password is very weak (less than an hour of brute force needed to access your VPS). It is therefore imperative to change it to a much longer password.

On the vast majority of Linux OSes, a single command (as root) is enough: "passwd root"

Enter new UNIX password:
Retype new UNIX password:```

The utility will ask you to enter the new root password you want to set twice. When you type these passwords, nothing appears on the screen: This is normal. Linux, unlike Windows, does not display stars or any character when a password is typed in the terminal.

#### 2/ Prevent BruteForce attacks

Server IP addresses are very regularly the target of Brute Force attacks. Even though a well-strengthened password is generally unbreakable (it would take centuries), setting up protection against BruteForce is very simple, takes only a few minutes, and will further protect your VPS.

The basic protection against these attacks is provided by the "fail2ban" package, capable of monitoring the logs of many services on your VPS, and temporarily blocking IPs that appear regularly in these logs.

This package is simply installed with the command "apt install fail2ban"

``` root@HelpDesk:~# apt install fail2ban
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
fail2ban python3-pyinotify python3-systemd whois
0 upgraded, 4 newly installed, 0 to remove and 64 not upgraded.
Need to get 424 kB of archives.
After this operation, 1967 kB of additional disk space will be used.
Do you want to continue? [Y/n]```

Once fail2ban is installed, all that is left is to configure it, using the following command:

root@HelpDesk:~# printf "[ssh] \nenabled = true \nport = ssh \nfilter = sshd \naction = iptables[name=SSH, port=ssh, protocol=tcp] \nlogpath = /var/log/auth.log \nmaxretry = 3 \nbantime = 900\n" > /etc/fail2ban/jail.d/ssh.conf


This will automatically create the file "/etc/fail2ban/jail.d/ssh.conf", with the following content

``` [ssh]
enabled = true
port = ssh
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = 3
bantime = 900```

This file is used to specify the location where the logs of the SSH service are found (/var/log/auth.log) by default, the number of attempts (maxretry=3) that an IP is allowed to make within the detection window (10 minutes by default), and the duration of the ban of that IP from the server (bantime = 900 → 15 minutes)

All that is left is to restart the fail2ban service using the following command, and your brute-force protection will be active.

``` root@HelpDesk:~# service fail2ban restart```

|| If by accident you get blocked from your server, and you do not want to wait for the 15-minute delay, you can flush the list of banned IPs using the command "iptables -F". To do this, you will need to access your VPS's shell via the console available in your control panel, then enter the root password of your VPS.

### 3/ Change the default SSH port

Changing the listening port of your SSH server will not protect you from targeted attack attempts (it is very easy for someone to find out which port your SSH server is actually listening on), but it will allow you to avoid bot/robot attacks that scan server IP addresses, looking for servers that are easy to hack.

To make this change, you simply need to edit the file /etc/ssh/sshd_config, and replace the line **Port 22** with **Port 8822**. You can of course replace 8822 with any other port number that is not already in use on your server. Also make sure that no "#" is present at the beginning of this line. If a # is present, remove it, otherwise this line will not be taken into account.

You then simply need to restart your ssh service using the command

root@HelpDesk:~# service ssh restart


||| After any modification to SSH, make sure to test your new configuration in a new console (keep the old console open). If for any reason your configuration was incorrect and you can no longer connect, the session still open in the first console would allow you to fix your mistake. Modifying the SSH configuration does not affect sessions that are already open. Even if you stop the SSH service, current sessions will remain open.