Hardening a 2-core 2GB Flexus Server: SSH, fail2ban, swap, BBR

A small 2-core, 2 GB server does not need a complicated setup, but it does need a disciplined first hour. The steps below are the ones I run on a Huawei Cloud Flexus instance in Beijing before putting anything public on it.

1. SSH keys only, no password login

Generate a key on your own machine, copy the public key to the server, and then turn password authentication off:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
# add your public key to ~/.ssh/authorized_keys, then chmod 600 that file
sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Keep a second, tested terminal session open while you restart sshd. If the new login fails, the old session is your way back in.

2. fail2ban for repeated login failures

On Debian-based systems, install fail2ban, enable the sshd jail, and check its status. The default ban time is short, so I raise it for the sshd jail and keep an eye on fail2ban-client status sshd during the first days. This does not replace key-only login; it only slows down noisy scanners.

3. Give a 2 GB machine breathing room with swap

With only 2 GB of RAM, a build or a package upgrade can stall. A 2 GB swap file is a safety valve, not a performance plan:

 sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile
 sudo mkswap /swapfile && sudo swapon /swapfile
 echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Check with free -h. If swap is used constantly, that is a signal to reduce the workload, not to add more swap.

4. Timezone and a minimal firewall

Set the timezone explicitly so logs and cron jobs read sensibly:

 sudo timedatectl set-timezone Asia/Shanghai
 sudo timedatectl

Then allow only what the server actually serves. In practice that is SSH from my own addresses where possible, plus HTTP/HTTPS if it is a web server, and nothing else inbound.

5. BBR for steadier network behaviour

On a current kernel, BBR can be enabled with a few sysctl settings:

 echo 'net.core.default_qdisc=fq' | sudo tee -a /etc/sysctl.conf
 echo 'net.ipv4.tcp_congestion_control=bbr' | sudo tee -a /etc/sysctl.conf
 sudo sysctl -p
 sysctl net.ipv4.tcp_congestion_control

Verify the last command prints bbr before calling it done.

The checklist I re-run after every rebuild

1. Key-only SSH works, password login is off.
2. fail2ban is running and the sshd jail is active.
3. free -h shows the swap file.
4. Timezone is Asia/Shanghai and the clock is synchronised.
5. Only needed ports are open, and BBR is confirmed.

None of this makes a small server invulnerable, but it removes the most common, most avoidable failures: stolen or guessed passwords, out-of-memory stalls during upgrades, confusing log times, and wide-open ports left over from the first boot.