Skip to content
Clodo
Intermediate6 minUpdated: 2026-09-13

Initial Security Hardening for Linux VDS/VPS Servers

Essential hardening checklist for fresh Ubuntu/Debian servers: SSH keys, UFW firewall, and fail2ban brute-force defense.

Verified against

OS
Ubuntu 22.04 / 24.04, Debian 12
OpenSSH
8.9+
Last checked
2026-09-13

Before you start

  • A root or sudo-capable user on the server
  • A terminal on your local machine (PowerShell is fine on Windows)
  • A console fallback (panel/KVM) in case you lock yourself out
On This Page
All Guides
Reading progress

As soon as a Linux server connects to the internet, automated bots target port 22 with continuous brute-force password attempts. Implementing fundamental hardening steps immediately is vital.

Linux Server Hardening & Security Rating

Server protection rating achieved when all security layers are applied.

100%
Security Score
✓Ed25519 SSH Key Authentication
+25 PTS
✓Disable Password & Direct Root Logins
+25 PTS
✓UFW Firewall (Default Deny)
+25 PTS
✓Fail2ban Automated Ban Shield
+25 PTS

Multi-Layered Linux VDS Defense Architecture

Execution order of packet filtering eliminating malicious bots before hitting the OS kernel.

ARCHITECTURE FLOW
1GİRİŞ
Inbound Threats & Bots

Port scanners and automated password dictionary attacks.

2DONANIM KORUMA
Clodo DDoS Defense

Volumetric SYN/UDP flood attacks are absorbed upstream.

3GÜVENLİK DUVARI
UFW (Default Deny)

Unlisted ports drop incoming packets silently without response.

4OTOMATİK BAN
Fail2ban Shield

IPs failing 3 consecutive logins are blacklisted for 24 hours.

5GÜVENLİ
Protected SSH & Apps

Only authentic Ed25519 keypairs gain console shell access.

1. SSH Key Authentication & Disabling Passwords#

Generate an Ed25519 keypair on your local machine, copy it to your server, then disable password logins:

Yerel Terminal / PowerShell
ssh-keygen -t ed25519 -C "admin@clodo"
ssh-copy-id -i ~/.ssh/id_ed25519.pub root@SUNUCU_IP
/etc/ssh/sshd_config.d/99-hardened.conf
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin prohibit-password

2. Setting Up UFW (Uncomplicated Firewall)#

Allow strictly necessary ports and block everything else:

Sunucu Terminali
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw enable

3. Security Management Comparison#

Method Comparison

How to Implement This?

How this maps to a Clodo service

Container model

Clodo plans are managed containers; the operating system and SSH daemon are not yours to configure. Most of the steps above therefore do not apply to a Clodo service -- here is what replaces them.

Where in Panel? Panel > Service detail > SFTP card shows the username, host and port you need for file access.
Step-by-step Execution:
  1. 1There is no root access or SSH shell; you reach files through the panel file manager or SFTP. That also means you cannot lock yourself out with a bad rule.
  2. 2You do not manage a firewall such as UFW; your service is reachable only on the port assigned in the panel, and everything else is already closed.
  3. 3Account security lives in your Clodo account rather than on the server: enable two-factor authentication and keep your panel password to yourself.
  4. 4To filter web traffic, you do it at the edge rather than on the box -- attach your domain to Cloudflare; see the Cloudflare WAF guide.

Was this guide helpful?

Feedback goes straight to the team that maintains this guide.

Related Guides

Creating Auto-Restarting Background Services with Systemd

How to configure systemd unit files to automatically restart Node.js, Python, Go, or game scripts on reboot and crash.

Container Management with Docker and Docker Compose on Linux

Install official Docker Engine on Ubuntu/Debian, write compose specifications, and isolate cloud workloads.