Comprehensive Linux VPS Hardening Blueprint for 2026

Securing a public-facing Linux virtual private server (VPS) requires a defense-in-depth strategy. By systematically restricting SSH authentication, tuning kernel network security flags, establishing automated firewall policies, and disabling unused services, you drastically minimize the server's attack surface.

1. Hardening OpenSSH Server Configuration

Password-based brute force attacks account for over 80% of automated VPS compromises. Enforce modern Public Key Authentication (Ed25519) and disable password-based logins completely.

Edit /etc/ssh/sshd_config.d/hardening.conf:

# Enforce SSH Key Authentication Only
PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# Restrict Encryption Ciphers & MACs
KexAlgorithms curve25519-sha256,[email protected]
Ciphers [email protected],[email protected]
MACs [email protected]

# Session Limits
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3

Test the configuration and reload the OpenSSH service:

sudo sshd -t && sudo systemctl reload sshd

2. Kernel Hardening via sysctl Parameters

Modify Linux kernel sysctl variables to protect against SYN flood attacks, IP spoofing, packet redirects, and memory inspection vulnerabilities.

Add the following settings to /etc/sysctl.d/99-security-hardening.conf:

# Disable IP Source Routing & ICMP Redirects
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Protect Against TCP SYN Flood Attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096

# Enable Reverse Path Filtering (Anti-Spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable ICMP Echo Requests Broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1

# ASLR (Address Space Layout Randomization)
kernel.randomize_va_space = 2

Apply settings immediately without rebooting:

sudo sysctl --system

3. Uncomplicated Firewall (UFW) Configuration

Default-deny inbound policy is mandatory. Only expose ports that are actively required (HTTP, HTTPS, SSH).

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment 'SSH Access'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw enable

4. Summary Checklist

• Disable password-based SSH authentication in favor of Ed25519 SSH keys.
• Enable UFW firewall with default deny incoming rules.
• Tune Linux kernel sysctl flags for SYN flood and spoofing defense.
• Keep system packages updated automatically using unattended-upgrades.