Linux VPS Configuration

Question

I just recently got my hands on a linux (Fedora) VPS and I would like to ask if there are special configurations that I have to be wary of. Do I still configure it like I would configure a normal virtual machine? Are there more things to take care of, or be cautious about because that machine is 24/7 available online, and can fall pray to those (hackers/crackers) seeking a machine to test their knowledge on?

I would appreciate your input.

Answer 1

In addition to Tim's suggestion, configure your user account to use ssh keys for authentication, then configure SSH to only accept key based auth (no passwords). Also make sure that root logins are disabled.

Here's a summary of the options that do this:

ChallengeResponseAuthentication no
HostbasedAuthentication no
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin no
PubkeyAuthentication yes
RSAAuthentication yes
RhostsRSAAuthentication no
UsePAM yes
UsePrivilegeSeparation yes

Remember, you must have key based login working before you disable password logins. Otherwise you will be locked out permanently.

Answer 2

Most VPS providers, if they have been around long enough, have a well known block of IP addresses, and tend to get a boat load of malicious traffic. I would be overly careful, lock it all down, and only open ports, etc. when you are sure they are secure and can handle some malicious traffic and shoot it down properly.