Setup Your VPS for Production

📝 Introduction

Setting up a VPS for production is essential for deploying applications efficiently and securely. This guide provides a detailed, step-by-step process to configure your VPS, ensuring optimal performance and security.

🌍 Choose the Right VPS Provider

Selecting a reliable VPS provider is crucial. Consider factors such as available resources (CPU, RAM, storage, bandwidth), scalability, customer support, and pricing.

ℹ️

For this guide, I’ll be using OVH as the VPS provider. You can choose any provider that suits your requirements.

Here are my recommendations for VPS providers:

🔑 VPS Setup

🔌 Connect to Your VPS

Once your VPS is set up, connect to it using SSH with your favorite SSH client. I’ll be using Windows Terminal.

ssh root@your-vps-ip

ℹ️

Your provider may create a default user for you, so you might need to use that instead of root.

Once you are connected, use: sudo su to switch to the root user if your default user is not root.

🔐 Change Root Password

It’s crucial to change the root password to a strong, unique password. Run the following command:

passwd

🔄 Update the System

Before installing any software, update the system to ensure you have the latest security patches and software updates. Run the following commands:

sudo apt update && apt upgrade -y && apt full-upgrade -y

📦 Install Essential Packages

Install essential packages that are recommended for any VPS server:

sudo apt install build-essential lsb-release software-properties-common apt-transport-https ca-certificates curl wget git zip nano

🔧 Install Linux Headers

Linux headers are necessary for building certain software packages. Install them with:

sudo apt-get install linux-headers-$(uname -r)

👤 User Management

👥 Create a New User

For security reasons, avoid using the root user for everyday tasks. Create a new user with sudo privileges:

adduser username
usermod -aG sudo username

🔓 Configure Sudo

To run sudo commands without entering a password, edit the sudoers file:

sudo visudo

Add the following line just before @includedir /etc/sudoers.d:

username ALL=(ALL) NOPASSWD: ALL

Log out and log back in with the new user:

exit
ssh username@your-vps-ip

🔐 Secure Your VPS

🔑 Setup SSH Keys

Using SSH keys for authentication enhances security. No more need to enter passwords every time you connect to your VPS. Generate an SSH key pair on your local machine:

ssh-keygen -t ed25519

Set up your SSH keys on your VPS:

mkdir ~/.ssh
chmod 700 ~/.ssh

Edit the authorized_keys file and paste your public key:

nano ~/.ssh/authorized_keys

Set the correct permissions:

chmod 600 ~/.ssh/authorized_keys

You can now connect to your VPS using your SSH keys instead of your password:

ssh username@your-vps-ip

🔒 Harden SSH Configuration

Hardening the SSH configuration is essential to prevent unauthorized access. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Change to the following settings:

Port 2222
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 3
MaxSessions 2

PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys

PasswordAuthentication no
PermitEmptyPasswords no

UsePAM no

Restart the SSH service:

sudo /etc/init.d/ssh restart

⚠️

If you changed the SSH port, make sure to add -p 2222 to the SSH command when connecting to your VPS since by default the SSH command will use port 22 by default.

🔥 Configure Firewall

To secure your VPS, configure a firewall using UFW, allowing you to control network traffic and protect your server from unauthorized access.

sudo apt install ufw

Set default policies:

sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow SSH:

sudo ufw allow 2222/tcp

Enable UFW:

sudo ufw enable

🛡️ Setup Fail2ban

Fail2ban protects your server from brute-force attacks. Install and configure Fail2ban:

sudo apt install fail2ban

Create a new configuration file:

sudo nano /etc/fail2ban/jail.local

Add the following content and edit according to your needs:

[DEFAULT]
ignoreip = 127.0.0.1/8 # Add your home IP address here
bantime = 2d
findtime = 1d
maxretry = 3
backend = auto
usedns = warn

[sshd]
enabled = true
port = 2222
backend = systemd
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
banaction = ufw

Restart Fail2ban:

sudo systemctl restart fail2ban

Check if Fail2ban is running:

/etc/init.d/fail2ban status

🌐 Domain Name Setup

🌐 Setting Up Domain

💡

If you don’t have/need a domain name, you can skip these steps.

To set up a domain name, point your domain to your VPS IP address by adding an A record in your domain registrar’s DNS settings.

Assume you want your server accessible at server.yourdomain.com. Add the following A record:

ℹ️

You can change server to any subdomain you prefer.

server in A your-vps-ip

ℹ️

DNS propagation can take up to 24 hours. Use DNS Checker to check the propagation status.

🏷️ Setting Up Hostname

Edit the hostname file:

sudo nano /etc/hostname

Replace the content with your desired hostname:

server

Edit the hosts file:

sudo nano /etc/hosts

Add the following line at the end of the file:

127.0.1.1 server.yourdomain.com server

Restart your VPS:

sudo reboot

Now, your VPS should be accessible at server.yourdomain.com, and you can connect with ssh username@server.yourdomain.com.

🎉 Conclusion

Congratulations! You have successfully set up your VPS for production. Your VPS is now secure, optimized, and ready for deploying applications and websites. If you will use Docker, check out my guide Installing Docker Stack.

aefly

🌐 ʟɪᴠɪɴɢ ɪɴ ᴀ ᴠɪʀᴛᴜᴀʟ ᴡᴏʀʟᴅ.