1. System Update & Timezone
# Update package repositories and upgrade existing packages
apt update && apt upgrade -y && apt autoremove -y
# Configure system timezone
timedatectl set-timezone UTC
# Install essential system tools and utilities
apt install -y curl wget git vim htop iotop ufw fail2ban
2. Sudo User & Ed25519 Key Auth
Direct root SSH access is a primary security hazard. Create a dedicated user deployer with administrative sudo privileges:
adduser deployer
usermod -aG sudo deployer
# Set up .ssh directory for user deployer
mkdir -p /home/deployer/.ssh && chmod 700 /home/deployer/.ssh
nano /home/deployer/.ssh/authorized_keys
# Paste your public SSH key, then restrict permissions:
chmod 600 /home/deployer/.ssh/authorized_keys
chown -R deployer:deployer /home/deployer/.ssh
3. Hardening SSH Daemon
Create /etc/ssh/sshd_config.d/99-hardened.conf to disable password-based brute force and customize ports:
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
Validate configuration syntax and restart SSH: sshd -t && systemctl restart ssh
4. UFW Firewall & Fail2ban
# Set default policies and allow custom SSH and web ports
ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp comment "Custom SSH Port"
ufw allow 80/tcp comment "HTTP"
ufw allow 443/tcp comment "HTTPS"
ufw enable
# Enable and start fail2ban service
systemctl enable --now fail2ban
5. Linux BBR & Swap Tuning
Google BBR congestion control substantially enhances TCP throughput over long-haul connections with high latency:
# Write sysctl network and memory optimizations
cat <<EOF > /etc/sysctl.d/99-custom.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
vm.swappiness = 10
vm.vfs_cache_pressure = 50
EOF
# Apply sysctl settings immediately
sysctl --system
# Verify BBR is actively running (should output bbr)
sysctl net.ipv4.tcp_congestion_control
Markus S.
Senior Cloud Infrastructure Architect & Linux Sysadmin
Markus focuses on European cloud hosting economics, server performance optimization, and KVM virtualization. All benchmarks, setup guides, and VAT exemption procedures are verified on self-funded Netcup instances hosted in the Nuremberg datacenter (AMD EPYC hardware).
📚 Recommended Reading: Essential Netcup Guides & Benchmarks
Hands-on tutorials to help you maximize savings, configure servers, and make informed choices
Netcup 0% VAT Exemption Guide: Automatic Tax Removal for Non-EU Users
Complete walkthrough on qualifying for automatic 0% German VAT, invoice updates, and billing formulas.
Netcup Registration & Order Guide: Identity Verification & Fraud Check Tips
From plan selection to CCP portal activation. Avoid order cancellations and delays.
Netcup vs Hetzner Cloud: Geekbench 6 Scores, Network Routing & Pricing Comparison
In-depth analysis of dedicated vCPU consistency, traffic quotas, and datacenter connectivity.
Netcup Custom ISO Tutorial: Install Windows & Linux via SCP Panel
Mount external ISOs with VirtIO drivers via Server Control Panel (SCP) and VNC access.
💰 Netcup Verified Coupons & Discounts
We maintain an updated collection of verified netcup discount codes, with real-time automatic synchronization. Get up to 30% off or free months on your next order.
Browse All Coupons →