If you just rented a fresh Linux VPS, default settings are not your friend. Password SSH, open ports, root logins, stale kernels — every one of those is a welcome mat for bots scanning the internet 24/7.
This is a four-part series that takes a raw Ubuntu or Debian VPS and turns it into a server you can actually leave running. No fluff, no theory — just commands, configs, and the reasoning behind each one.
Who this is for
- You just rented your first VPS (Hetzner, Contabo, Vultr, DigitalOcean, etc.)
- You want to self-host apps, Docker containers, or a blog — and you want it secure
- You don't want to read a 50-page SANS guide before running your first
ufw allow
The series
Harden Your Linux VPS in 10 Minutes
The baseline. Non-root user, SSH keys only, UFW firewall, automatic security updates, a sensible sshd_config. If you do nothing else, do this.
Docker Security Best Practices for Self-Hosters
Once containers enter the picture, the attack surface changes. Rootless Docker, read-only filesystems, capability dropping, network isolation, and image scanning — everything the official docs gloss over.
READ PART 2 →SSH Hardening: The Ultimate Guide for 2026 Apr 29
Goes deeper than Part 1 on SSH specifically: Ed25519 keys, port changes (and why they're controversial), Fail2Ban integration, 2FA with TOTP, match blocks, bastion patterns.
Setting Up Fail2Ban the Right Way May 2
Intrusion detection and auto-banning for SSH, web servers, and Docker containers. Custom filters, email alerts, and how to avoid locking yourself out of your own server.
Start here
Work through the parts in order — each one assumes the baseline from the previous. If you only have 10 minutes today, Part 1 alone moves your server from "public bullseye" to "not worth bothering with" for 99% of the bots scanning the internet.
New parts ship on the dates above. Subscribe below to get each one the morning it publishes.