3 basic linux security settings for a VPS that everyone should make

In this episode we have a look into basic linux security on a vps and I will show 3 basic security settings for linux:

basic linux security settings for linux like configuring and securing ssh, securing ssh server with ssh-keygen , firewall ufw but also using a non root user with useradd or usermod can greatly increase the basic vps security.
The linux firewall setup of course is crucial as well, we will use the linux firewall ufw to achieve this.

0:00 intro

0:50 the security challenge

2:00 creating a non root user
3:54 ssh security - configuring and securing ssh server
5:16 importing the key into putty or WinSCP
5:39 reviewing the ssh settings on the ssh server
7:00 linux firewall
8:10 opening ports on the firewall with ufw
8:55 call to action
9:50 closing

we will use useradd, usermod, ssh-keygen and ufw in order to achieve this.
These basic vps security settings should be done on any vps, i.e. virtual server running in the cloud.

related videos:

[politubeyou]

Wonderfully clearly explained. I love your deep voice and relaxed presentation. Looking forward to more videos from you. Thank you very much!

[oceanz]

That was great Marc! Linux is a never ending rabbit hole and I'm loving it. Just recently bought a new Ubiquity network switch and am in the midst of revamping everything (now that I'm home!!) starting with the home office build... The point is that I am very happy I have such videos to refer back to when the time comes....Thanks again!

[PaiMai]

More videos related to it-security would be great.

[Smitch]

I installed an openvpn server on a 1&1 vps just like you showed in one of your previous videos and now followed this to lock it down, like you i saw lots of failed logins.... unbelievable!
Just one question though, is it normal for putty/winscp to ask for the "passphrase for imported key" ? Keep up the good work I find your videos really helpful.

[ukplexpress]

I use ZeroTier for administration. And allow olny access form ZieroTier subnet.

[FabioSpelta]

A lot of people underestimates the need to know your own ssh fingerprint. A man in the middle can happily screw you if he gets between you and the server BEFORE you connect the very first time from a new system if you just click "y" on the prompt that asks "this is the server's fingerprint, do you want to continue?"

[IMBlakeley]

No need for Putty anymore on windows, can run ssh commands directly from either powershell or dos.
I have a script that updates the allowed IPs for UFW by querying DNS. If I am say on the mobile out and about I can update my dynamic dns, wait 5 minutes and the server will open the firewall port for that IP, everything else is blocked..

[pichonPoP]

I've been using ssh on my own server since 2017. Iptables DROP policy + ssh key ed255 + some tweak in sshd_config and ssh_config. BTW root account disabled at my end.

[defectivehamster]

Interesannt. Deine vps erinnert mich an die xbox :P

[henning]

I just rented a IONOS server for just 1€/month.
When I startet "netstat -tulpn" I got al lot of running services. Ok the ports are not open to the world, but would it not be better to stop all this unneeded services. I.e. dovecot, apache2, mysqld, nginx, grafana-server ?
I just need wireguard and socat, sshd ....

[defectivehamster]

I would like to know more about reverseproxy - nginx

[FabioSpelta]

Also when the sudo privileges are ALL:ALL is there actually a difference between being pwn3d with root? 🤔

[jonathanpayne]

Now i am worried! So you have convinced me that i can move my self hosted vpn (openvpn and wireguard) to a vps and gain security and multiple tunnels to up the speed - i suspect that i will be able to use this in china too and i can even slap it on a common port like 80. maybe ditch my subscriptions to expressvpn as a fallback ! but i know then i have a vps ! so i will want to slap docker on it and offload some or all my containers to it too! then i have the thought! vps running docker and maintained containers with the vpn goodness in! is that workable?

[awabomer]

There is only 1 problem, the video in the background is out of sync from what you are saying, other than that it's great