![[DoRoyal] Logo](https://cdn.doroyal.com/2026/08/DoRoyal_by_Sidular-1-scaled.png)
New servers on the public internet are scanned by bots within minutes of coming online. This guide covers the essential first steps to secure your DoRoyal VPS.
1. Set Up SSH Key Authentication
On your local machine, generate a key pair (skip if you already have one):
ssh-keygen -t ed25519
Copy the public key to your VPS:
ssh-copy-id root@YOUR_SERVER_IP
Test that key login works before proceeding:
ssh root@YOUR_SERVER_IP
You should log in without being asked for the root password.
2. Disable Password Authentication
Only after confirming key login works. Edit the SSH configuration on the server:
nano /etc/ssh/sshd_config
Set the following directives:
PasswordAuthentication no PermitRootLogin prohibit-password
Then restart SSH:
systemctl restart sshd
Tip: Keep your current SSH session open and test a new connection in a second terminal. If something is wrong, you can still fix it from the open session - or use the King Panel VNC console as a lifeline.
3. Enable a Firewall
Debian/Ubuntu (UFW):
apt install ufw -y ufw allow OpenSSH ufw allow 80/tcp ufw allow 443/tcp ufw enable
AlmaLinux/Rocky (firewalld):
dnf install firewalld -y systemctl enable --now firewalld firewall-cmd --permanent --add-service=ssh firewall-cmd --permanent --add-service=http firewall-cmd --permanent --add-service=https firewall-cmd --reload
Only open the ports your applications actually need.
4. Keep Your System Updated
apt update && apt upgrade -y # Debian/Ubuntu dnf update -y # AlmaLinux/Rocky
Consider enabling automatic security updates (unattended-upgrades on Debian/Ubuntu, dnf-automatic on RHEL-based systems).
5. Optional Hardening
- fail2ban - automatically bans IPs that repeatedly fail login attempts
- Non-root user - create a regular user with
sudoand stop logging in as root directly - Backups - schedule regular off-server backups; as an unmanaged service, backups are your responsibility
Locked Yourself Out?
If a firewall rule or SSH change locks you out, use the VNC console in the King Panel to log in directly and revert the change.
