How to Secure an Ubuntu 24.04 VPS: SSH Keys, UFW & Fail2ban

1. Initial Provisioning & Sudo User Creation

When you spin up a fresh KVM instance from top providers like IwiHost.net, the first critical step is establishing a non-root superuser. Operating exclusively as root leaves zero safety buffer against typos or automated credential stuffing.

adduser deployer
usermod -aG sudo deployer
su - deployer

2. Hardening SSH with Ed25519 Keys

Legacy RSA 2048 keys are being deprecated across enterprise security policies. Instead, generate modern elliptic-curve Ed25519 keypairs. Edit /etc/ssh/sshd_config to disable password authentication completely:

PasswordAuthentication no
PermitRootLogin prohibit-password
X11Forwarding no

3. Configuring UFW Firewall

Close all unused ingress ports and strictly whitelist only required services (e.g. SSH, HTTP, HTTPS):

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

4. Automated Bot Defense with Fail2ban

Install and configure Fail2ban to monitor SSH connection logs and enforce progressive bans on suspicious IP ranges.