Lock the Doors

Why bother

You're not being paranoid

The moment your VPS got an address, strangers started knocking.

All day, every day, computers around the world scan the internet just looking for addresses that answer. When they find one, they try common usernames and passwords, over and over, hoping one works. This isn't you being targeted — it's just background noise on the internet. But it means an open door with a weak lock will get tried.

1 Step One

Update everything

Fresh machines ship with software that's already a little out of date. Bring it current before anything else.

This can take a few minutes the first time. Let it finish.

2 Step Two

Make yourself a normal user

root can do absolutely anything — including delete something important by a single typo. From here on, you'll log in as a regular user who has to ask for superpowers each time, using a word called sudo.

Swap rob for whatever name you like. That second line is what grants "ask for superpowers" access — without it, your new user couldn't do admin work at all.

3 Step Three

Trade your password for a key

A password is a secret anyone could guess. A key is a lock and its one matching key — nobody can talk their way past it.

You make the pair on your own PC: a private key that never leaves it, and a public key you hand to the VPS. The VPS will only let the matching private key in.

Now send the public half up to your VPS, into your new user's account:

Then test it — open a brand-new PowerShell window (leave the old one open, just in case) and try:

4 Step Four

Turn on the firewall

A firewall is a bouncer standing at every door, checking a list. Only the doors on the list get opened — everything else gets turned away, no questions asked.

Allowing OpenSSH first is what stops you from locking yourself out the moment you turn it on. Later, when your website goes live, you'll add two more doors here: HTTP and HTTPS.

5 Step Five

Shut the root door for good

Your key works. Your firewall's up. Now close the two doors bots try hardest: logging straight in as root, and logging in with only a password.

Find these two lines and change them to no (if there's a # in front, remove it):

• 1PermitRootLogin no — root can no longer log in directly, from anywhere.
• 2PasswordAuthentication no — passwords stop working entirely. Keys only, from here on.

Save with Ctrl+O, then Enter, then close with Ctrl+X.

Before you reload anything, check for a sneaky second file. Some Ubuntu VPS images ship a cloud-init file that quietly sets PasswordAuthentication yes again, overriding the edit you just made:

If a file shows up with yes — commonly named 50-cloud-init.conf — open it and change that line too:

Saved everything? Now reload:

One more thing while you're in here: your provider's control panel still shows a default root password, sitting there in plain text. SSH won't accept it anymore — but some providers' emergency rescue console bypasses SSH entirely and could still ask for it. Change it so nothing default is left lying around:

Save it somewhere safe, like a password manager. You'll only ever need it in an emergency, through that rescue console.

Recap

What's locked now

• ✓
  Software is currentapt update && apt upgrade
• ✓
  You have a real user, not just rootadduser + sudo group
• ✓
  Login uses a key, not a passwordssh-keygen + authorized_keys
• ✓
  A firewall is standing guardufw, SSH allowed, everything else blocked
• ✓
  Root login and passwords are both offPermitRootLogin no · PasswordAuthentication no
• ✓
  Default root password changedsudo passwd root — for rescue console emergencies only