Hardening Two Debian 12 Cloud Instances: My Practical Checklist

I run two small Debian 12 cloud instances (the $7/month Lightsail plan: 1 vCPU, 1 GB RAM). They host a few personal services, so I worked through a hardening checklist and applied it to both boxes. Everything below was actually run on live instances — no theory.

1. Bind a static IP
Cloud instances can get a new public IP after a stop/start cycle. I attached a static IP to each instance so DNS records and firewall rules don't break, and so fail2ban logs stay readable with one stable address per box.

2. Firewall: only 22/80/443
The cloud firewall is the first line of defense. I allow inbound TCP on 22 (SSH), 80 and 443 (web) only; everything else is denied by default. Fewer open ports means a smaller attack surface.

3. SSH: keys only, no passwords
Password authentication is the first thing attackers brute-force. In /etc/ssh/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin prohibit-password

Then systemctl restart sshd. Important: keep your current SSH session open while you test a new login in a second terminal — one typo here can lock you out.

4. fail2ban on Debian 12: don't forget backend=systemd
This one bit me. On Debian 12, the default sshd jail can silently fail to read auth logs because it expects the old log-file layout. The fix is a small /etc/jail.local:

[sshd]
enabled = true
backend = systemd

Then systemctl enable --now fail2ban, and verify with fail2ban-client status sshd. Within a day you should see banned IPs accumulating — proof it's working.

5. Give the box some swap (2 GB, swappiness=10)
1 GB of RAM is tight. I created a 2 GB swap file:

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

And set vm.swappiness=10 in /etc/sysctl.d/99-swap.conf. With swappiness=10 the kernel prefers RAM and only swaps under real memory pressure — a safety net, not a crutch. Add the swapfile to /etc/fstab so it survives reboots.

6. Enable BBR + fq
For better throughput on long network paths:

net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr

in /etc/sysctl.d/99-bbr.conf, then sysctl --system. Verify with sysctl net.ipv4.tcp_congestion_control (should print bbr) and lsmod | grep bbr. SSH sessions feel snappier and transfers are steadier.

7. unattended-upgrades for automatic security patches
I don't want to babysit apt. Install unattended-upgrades, run dpkg-reconfigure -plow unattended-upgrades and answer Yes. Logs land in /var/log/unattended-upgrades/. Security updates install themselves; I only handle major upgrades manually.

8. Set the timezone to Asia/Shanghai
timedatectl set-timezone Asia/Shanghai. Trivial, but it makes logs, cron jobs and certificate-expiry warnings readable at a glance instead of mental UTC math.

Wrapping up
None of this is exotic: static IP, minimal firewall, key-only SSH, fail2ban with the right backend, a bit of swap, BBR, automatic updates, correct timezone. Together they turn a $7 box from a default install into something I'd trust on the open internet. The whole checklist takes about 20 minutes per instance, and most of it is one-time work.