公网 VPS 一上线，全网爬虫就开始扫你的端口、爆破 SSH。下面几步把门关好。
1. 防火墙：默认拒绝，只放必要端口
Ubuntu/Debian 用 ufw：
ufw default deny incoming ufw allow 你的SSH端口/tcp ufw allow 80,443/tcp ufw enable
⚠️ 先放行 SSH 端口再 enable，否则当场把自己挡在外面。
2. fail2ban：自动封爆破 IP
装上 fail2ban 后，多次登录失败的 IP 会被自动封一段时间，专治 SSH 爆破。apt install fail2ban 默认就护 SSH。
3. 其它基本功
提醒
装了 宝塔 / 1Panel 面板的，面板端口和弱口令也是常被扫的目标，记得改默认端口 + 强密码。
还没挑好机器？去 库存监控 按线路 / 地区筛选在售机型。
The moment a public VPS goes online, bots across the internet start scanning your ports and brute-forcing SSH. Here are a few steps to lock things down.
1. Firewall: Default Deny, Allow Only Necessary Ports
For Ubuntu/Debian, use ufw:
ufw default deny incoming ufw allow your-ssh-port/tcp ufw allow 80,443/tcp ufw enable
⚠️ Allow your SSH port before running enable — otherwise you’ll lock yourself out immediately.
2. fail2ban: Automatically Block Brute-Force IPs
Once fail2ban is installed, IPs that fail login too many times get automatically banned for a period. It protects SSH out of the box. Just run apt install fail2ban.
3. Other Basic Hardening
- Use SSH key authentication and disable root password login.
- Change the SSH port (reduces scan noise — not a core security measure, but still useful).
- Keep packages updated with
apt upgradeand disable unused services.
Reminder
If you’re using a panel like aaPanel / 1Panel, the panel port and weak passwords are also common scan targets — change the default port and use a strong password.
Still looking for a VPS? Visit the stock monitor to filter by network line and region.
发表回复