A Must-read For Technical Teams On Key Points Of VPS Security Hardening And Permission Settings In Malaysia

You should start with the operating system and basic configuration. It is recommended to disable unnecessary services, patch promptly, enable automatic update policies, and remove default accounts and sample files. Externally exposed services should follow the principle of minimizing exposure, retaining only the ports needed by the business. For login entrances, you are required to use a key login with an alternative password, and you can disable root login directly, set non-default SSH ports, and use anti-blasting tools like Fail2ban.

Implement the following checklist: 1) System patches and kernel updates; 2) Shutting down unnecessary services; 3) Strengthen SSH authentication (key + disable password); 4) Restrict sudo permissions; 5) Install and configure the host firewall (such as iptables or firewalld); 6) Enable mandatory access control such as SELinux or AppArmor.

Create a new administrator user on the VPS and configure the key: create a user, join the sudo group, place the public key in ~/.ssh/authorized_keys, disable PermitRootLogin and PasswordAuthentication in the sshd_config, then restart the sshd.

Before modifying the SSH configuration, please keep the session open to avoid accidental bans; It is recommended to test new connections after changes and reserve emergency console access.

Permission settings should follow the principle of least privilege. Establish layered user roles (such as operations, development, monitoring), with each role granted only the permissions needed to complete the work. Avoid account sharing; all sensitive operations are recorded through personal accounts and in audit logs. For situations requiring temporary permissions, use the sudo timewindow or temporary IAM policy and record the approval chain.

File and directory permissions should use strict Unix file permissions and ACLs; critical configuration files are limited to root or specific users only. For services such as databases and object storage, use independent accounts and least privilege keys to avoid hard-encoding credentials in code or public repositories.

Establish a process of permission application-approval-execution-retrospection. Changes must be recorded in the CMDB or change control system and reviewed after changes to ensure permissions do not exceed limits for extended periods.

Configuration consistency can be managed using Ansible and Terraform, combined with Vault or Secret Manager for centralized credential management, avoiding distributed plaintext storage.

First, clarify which IPs/networks need access to the VPS, use a whitelist policy to restrict management ports, and only allow company VPNs or VPN devices to access management services. Dual-layer protection is used with host firewalls (iptables, nftables, firewalld) and cloud vendor security groups, with only necessary ports open and management interfaces bound to the internal network.

Services are grouped: management (SSH, RDP), application ports (80/443/service ports), and database ports. For management ports, mandatory multi-factor authentication (MFA) combined with VPN or jump board access is required.

Example: Denying all inbound traffic (default DROP), allowing TCP 22/443 from the management subnet, allowing load balancing or frontend IP access to 80/443. Outbound traffic can be limited to speed or restricted to necessary destinations.

Deploy traffic monitoring and anomaly alerts (such as Suricata, Bro/Zeek, cloud flow logs), combined with threshold alerts to promptly respond to abnormal connections or port scans.

Logs are at the core of post-event traceability and real-time alerts. Centrally collect system logs, application logs, and security events to ELK/EFK or cloud log services, ensuring a retention period of at least 90 days (adjusted according to compliance requirements). Enable auditing for critical operations (sudo, SSH login, configuration changes, database access).

Set baseline behavior models, define suspicious behaviors (such as multiple failed logins in a short period, abnormally high traffic uploads, profile mutations), and establish automated alerts. Combining IDS/IPS (such as Suricata) and host-type proxies (OSSEC/Wazuh) enhances detection capabilities.

Develop emergency procedures including testing, isolation, forensics, recovery, and review. When an incident occurs, the primary evidence is preservation (snapshots, logs), isolating affected instances to avoid secondary destruction, and then performing full recovery and root cause analysis in the isolation environment.

For services operating in Malaysia, pay attention to local data protection regulations and cross-border transmission requirements, ensuring that log storage and backup comply with compliance and client contract requirements.

Backups should follow the 3-2-1 principle: at least 3 copies of data, 2 media types, and 1 remote copy should be retained. Backups require regular recovery drills to verify snapshots, incremental backups, and database consistency. Backup credentials and encryption keys must be isolated from the production environment and managed using KMS or hardware security modules.

If an administrator account is compromised, the relevant credentials should be revoked, temporary permissions rolled back, keys reset, and all potentially leaked credentials replaced. Create an emergency recovery account and freeze access credentials for emergencies, but do not activate the account normally.

Quickly rebuild environments using IaC and automated scripts, conduct regular disaster recovery drills, and verify whether RTO/RPO meets business needs. During the drill, permission configuration, key rotation, and the completeness of the audit chain were also checked.

The above provides practical directions and tool suggestions regarding VPS security hardening and permission settings. Technical teams should implement them under Malaysian regulations and cloud vendor characteristics based on specific business scenarios.