VPS Security Hardening for Bangladesh Businesses: Firewall, SSH, Fail2ban

The moment your VPS gets an IP address, it starts receiving connection attempts. Port scanners, SSH brute-force bots, and vulnerability crawlers hit every public IP on the internet within minutes of it going live. This isn't theoretical — check your auth logs after an hour:

sudo cat /var/log/auth.log | grep "Failed password" | wc -l

You'll likely see dozens or hundreds of failed attempts already. The good news is that hardening a VPS against these attacks is straightforward and takes less than an hour.

This guide covers essential security steps for a VPS running Ubuntu 22.04 — applicable whether you're on a BDIX VPS, Singapore VPS, or USA VPS from SNBD HOST.

1. Disable Root SSH Login

Root is the most powerful account on any Linux system. Attackers know this and target it specifically. Disable direct root SSH access:

sudo nano /etc/ssh/sshd_config

Set these values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30

Restart SSH:

sudo systemctl restart sshd

Make sure you have a non-root sudo user with an SSH key set up before doing this, or you'll lock yourself out.

2. Change the SSH Port

Automated bots scan port 22 constantly. Changing the port doesn't make your server more secure against a determined attacker, but it eliminates 99% of automated noise. Pick a number between 1024 and 65535:

sudo nano /etc/ssh/sshd_config

Port 2222

Allow the new port through the firewall before restarting SSH:

sudo ufw allow 2222/tcp
sudo systemctl restart sshd

From now on, connect with: ssh -p 2222 yourname@YOUR_VPS_IP

3. Configure UFW Firewall

UFW (Uncomplicated Firewall) is the simplest way to manage iptables rules on Ubuntu. The principle: deny everything by default, allow only what you need.

sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow your custom SSH port
sudo ufw allow 2222/tcp

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable the firewall
sudo ufw enable

# Check status
sudo ufw status verbose

Add other ports as needed. For a mail server, you'd add 25, 587, 993. For a game server, add your game's port. For a database that only needs local access, add nothing — it stays private.

Restrict SSH to Specific IPs (Optional but Powerful)

If your office or home has a static IP (available from most Bangladeshi ISPs for a small monthly fee), restrict SSH to that IP only:

sudo ufw allow from YOUR_OFFICE_IP to any port 2222

This makes SSH completely inaccessible from any other IP on the internet.

4. Install and Configure Fail2ban

Fail2ban monitors log files and temporarily bans IPs that show signs of brute-force activity. It's essential on any public-facing server.

sudo apt install fail2ban -y

Create a local configuration file (never edit the default — it gets overwritten on updates):

sudo nano /etc/fail2ban/jail.local

Paste this configuration:

[DEFAULT]
bantime  = 3600
findtime  = 600
maxretry = 5
ignoreip = 127.0.0.1/8

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400

This bans any IP that fails SSH authentication 3 times within 10 minutes — for 24 hours. Start and enable Fail2ban:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check which IPs are currently banned:

sudo fail2ban-client status sshd

Protect Nginx with Fail2ban

If you're running a web server, also protect against HTTP attacks:

[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

[nginx-limit-req]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

sudo systemctl restart fail2ban

5. Enable Automatic Security Updates

Outdated packages are the most common entry point for server compromises. Automate security updates:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Edit the configuration to enable automatic updates:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Make sure this line is uncommented:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

And enable automatic upgrade:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

6. Harden Shared Memory

Shared memory can be exploited by certain attacks. Mount it with restricted permissions:

sudo nano /etc/fstab

Add this line at the end:

tmpfs /run/shm tmpfs ro,noexec,nosuid 0 0

7. Install and Run Lynis (Security Audit)

Lynis is a security auditing tool that checks your system configuration and gives you a score with recommendations:

sudo apt install lynis -y
sudo lynis audit system

The output includes a hardening index (0–100) and a list of suggestions. Work through the high-priority ones. You don't need to fix everything — but items marked warning or suggestion in critical categories should be addressed.

8. Regular Backups

Security hardening can't prevent all failures. Hardware can fail. You can accidentally delete files. A backup strategy is non-negotiable for a business VPS.

Simple backup with rsync to another server:

rsync -avz /var/www/ backup-server:/backups/$(date +%Y%m%d)/

Schedule it in cron:

crontab -e

0 3 * * * rsync -avz /var/www/ backup-server:/backups/$(date +%Y%m%d)/

This runs at 3am daily. Keep at least 7 days of backups. Test restoration periodically — a backup you've never restored is a backup you don't trust.

9. Monitor Login Activity

Check who has logged in recently:

last -20

Check failed login attempts:

sudo grep "Failed password" /var/log/auth.log | tail -20

If you see successful logins from IPs you don't recognize, change passwords and SSH keys immediately.

Security Checklist Summary

• Root SSH login disabled
• Password authentication disabled (SSH keys only)
• SSH port changed from 22
• UFW firewall enabled with default deny
• Fail2ban running with SSH protection
• Automatic security updates enabled
• Regular backups configured
• Lynis audit completed and high-priority items addressed

A properly hardened VPS running these configurations handles the vast majority of automated attacks without any intervention. The goal isn't perfect security (nothing is) — it's making your server a hard enough target that automated bots move on to easier victims.

For Bangladesh businesses, this is especially important because BDIX VPS IPs are sometimes targeted by regional actors who know Bangladesh businesses tend to run underprotected servers. Don't be the easy target.