On this page

• Current VPS
• Script Overview
• Usage
• Key Steps (Manual Reference)
  • System Updates
  • SSH Hardening
  • Tailscale VPN
  • Firewall
  • Fail2Ban
  • Automatic Updates
• Logging
• Troubleshooting

VPS Setup & Hardening

This guide summarizes the initial setup and security hardening steps for a new Ubuntu VPS. The process is automated in an idempotent, interactive script.

Current VPS

• Provider: Contabo VPS
• Hostname: vmi2813472
• Public IP: 158.220.100.30
• OS: Ubuntu 24.04 (Noble)
• Tailscale IP: 100.125.3.44

Script Overview

The setup script performs the following:

• Creates users and adds them to sudo.
• Installs and configures SSH keys.
• Disables password auth and root login.
• Optionally changes the SSH port.
• Installs and enables UFW, Fail2Ban, and unattended upgrades.
• Logs output to /var/log/vps-setup.log.

Usage

sudo bash vps-setup.sh

Key Steps (Manual Reference)

System Updates

sudo apt update && sudo apt upgrade -y

SSH Hardening

• PasswordAuthentication no
• PermitRootLogin no
• PubkeyAuthentication yes

Config file: /etc/ssh/sshd_config

Tailscale VPN

Tailscale provides secure access to the VPS without exposing SSH to the public internet.

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# Start and enable
sudo systemctl enable --now tailscaled

# Authenticate (follow the URL)
sudo tailscale up

# Verify
tailscale status
tailscale ip -4

Current Tailscale network:

SSH via Tailscale:

# From any Tailscale-connected machine
ssh bernard@100.125.3.44

# Or using hostname
ssh bernard@vmi2813472

Firewall

sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable

Fail2Ban

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Automatic Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -f noninteractive unattended-upgrades

Logging

All script output is written to /var/log/vps-setup.log with restricted permissions.

Troubleshooting

• If SSH access breaks after changing ports, revert the port via console access.
• Confirm SSH service is running: sudo systemctl status ssh.
• Check Tailscale status: tailscale status or systemctl status tailscaled.