This is the process which I use when setting up a new VPS before it touches or does anything

This guide is based off of Debian 13, so should work with similar Debian versions and Debian based distros like Ubuntu

Initial Server Setup & Hardening

1. SSH into the machine using the root user/pass

   ssh root@ip -p 22
   

2. Update:

   apt update && apt upgrade -y
   

3. Create a non-root user:

   adduser viper # create user
   usermod -aG sudo viper # adds user to sudo group
   su viper # su = switch user
   

   Insert password then click enter to default others

   exit
   exit # again to get out of su
   

   Then log into ssh using your new user

   ssh viper@ip -p 22
   

4. Enable automatic security updates:

   sudo apt install unattended-upgrades -y
   sudo dpkg-reconfigure unattended-upgrades
   

5. If using windows:

   ssh-keygen -t ed25519 -C "vipervps"
   

   Click enter to set defaults

   Move the key to the server:

   type $env:USERPROFILE\.ssh\id_ed25519.pub  | ssh viper@ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
   

   Ensure it works

   exit
   

   ssh viper@ip
   

6. SSH Hardening

   sudo vim /etc/ssh/sshd_config
   

   Apply the following:

   Port 2200
   PermitRootLogin no
   PasswordAuthentication no
   PubkeyAuthentication yes
   AllowUsers viper
   

   Restart ssh

   sudo systemctl restart ssh # (or sshd)
   

   Usually best here to open a new terminal and attempt to connect before you lock yourself out, if you do most VPS providers have a rescue option

7. UFW Firewall

   Install:

   sudo apt install ufw -y
   

   Default Policies:

   sudo ufw default deny incoming
   sudo ufw default allow outgoing
   

   Allow SSH:

   sudo ufw allow 2200/tcp comment 'SSH'
   

   If hosting web servers:

   sudo ufw allow 80/tcp
   sudo ufw allow 443/tcp
   

   Enable UFW:

   sudo ufw enable
   

   Check UFW status:

   sudo ufw status verbose
   

8. Basic Kernel and Network Hardening: disabling ICMP redirects, source routing and broadcast pings, enabling SYN cookie protection against SYN flood DDoS attacks

   sudo vim /etc/sysctl.conf
   

   Add the following:

   net.ipv4.conf.all.accept_redirects = 0
   net.ipv4.conf.default.accept_redirects = 0
   
   net.ipv4.conf.all.send_redirects = 0
   net.ipv4.conf.default.send_redirects = 0
   
   net.ipv4.conf.all.accept_source_route = 0
   net.ipv4.conf.default.accept_source_route = 0
   
   net.ipv4.icmp_echo_ignore_broadcasts = 1
   net.ipv4.tcp_syncookies = 1
   

   Apply

   sudo sysctl -p
   

The VPS now should be pretty secure

Installing Nginx & Hosting a Static Site

1. Nginx Install:

   sudo apt install nginx -y
   

2. Firewall allow web traffic:

   sudo ufw allow 'Nginx Full'
   

3. Put website files into /var/www/site-here

4. Put config into sites-available

   sudo vim site-config
   

   server {
       listen 80;
       listen [::]:80;
   
       server_name domain-here.com www.domain-here.com;
   
       root /var/www/site-here;
       index index.html index.htm;
   
       location / {
           try_files $uri $uri/ =404;
       }
   }
   

5. Enable the site

   sudo ln -s /etc/nginx/sites-available/site-config /etc/nginx/sites-enabled/
   sudo rm /etc/nginx/sites-enabled/default
   

6. Test and reload

   sudo nginx -t
   sudo systemctl reload nginx
   

7. Add HTTPS with Let’s Encrypt

   sudo apt install certbot python3-certbot-nginx -y
   sudo certbot --nginx -d domain-here.com -d www.domain-here.com
   

and ur done!