VPS প্রথম সেটআপ — Server Hardening

🚀 Day 1 Checklist

1. SSH login as root
2. Update system
3. Create non-root user
4. Disable root login
5. Disable password auth
6. Change SSH port
7. Setup UFW
8. Install Fail2ban
9. Auto security updates
10. Time zone, swap setup

1️⃣ First Login & Update

ssh root@your-server-ip

apt update && apt upgrade -y
apt install curl wget vim git ufw fail2ban htop -y

2️⃣ Create Non-root User

adduser deploy
# password set, info skip OK

usermod -aG sudo deploy

# Test
su - deploy
sudo whoami    # should output: root

3️⃣ SSH Key Setup

# From your local machine
ssh-copy-id deploy@your-server-ip

# Or manual
ssh deploy@server-ip
mkdir ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
# Paste your local id_ed25519.pub content
chmod 600 ~/.ssh/authorized_keys

4️⃣ Harden SSH Config

sudo nano /etc/ssh/sshd_config

# Set these:
Port 2222                       # custom port
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers deploy
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3

# IMPORTANT: keep current SSH session open!
# Test in NEW terminal first:
ssh -p 2222 deploy@server-ip

# If new connect works, restart
sudo systemctl restart sshd

5️⃣ UFW Firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp     # SSH (your custom port!)
sudo ufw allow 80,443/tcp   # web
sudo ufw enable

sudo ufw status verbose

6️⃣ Fail2ban

sudo apt install fail2ban -y

# Custom config
sudo nano /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port = 2222
maxretry = 3

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

7️⃣ Auto Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

# Verify
cat /etc/apt/apt.conf.d/50unattended-upgrades
cat /etc/apt/apt.conf.d/20auto-upgrades

8️⃣ Timezone & Swap

# Timezone
sudo timedatectl set-timezone Asia/Dhaka

# Swap (1GB RAM server especially)
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo "/swapfile none swap sw 0 0" | sudo tee -a /etc/fstab

# Verify
free -h

9️⃣ Hostname

sudo hostnamectl set-hostname myapp-prod
echo "127.0.1.1 myapp-prod" | sudo tee -a /etc/hosts

🛡️ Verify Hardening

# Should fail
ssh root@ip                # connection refused
ssh -p 22 deploy@ip        # port closed

# Should work
ssh -p 2222 deploy@ip      # ✅

🎓 মূল কথা ⭐

Hardening = 30 minute। Skip করলে 24 ঘণ্টায় brute force শুরু (log দেখুন!)। Custom port + key only + Fail2ban = 99% bot block।