Hardening a Small Flexus Server: SSH, fail2ban, Swap and BBR

A 2-core, 2 GB cloud server is enough for a small site, but it leaves little room for mistakes. The hardening below is what I actually do first on a fresh Ubuntu server, before installing any application.

1. Start with SSH, not passwords

Disable password login and root login, and use a key only. In /etc/ssh/sshd_config I set PasswordAuthentication no and PermitRootLogin no, then restart sshd. I keep one working SSH session open while testing a second session, so a bad config cannot lock me out.

I also change nothing exotic: the goal is fewer ways in, not a clever setup I will forget. Key files stay on my own machine, never in the repository.

2. Let fail2ban do the boring blocking

Public servers get constant login attempts. fail2ban watches the SSH log and temporarily bans addresses that fail repeatedly. I enable the sshd jail, check it with fail2ban-client status sshd, and confirm the service is running after a reboot. It does not replace key-only login; it just stops the noise from filling the logs.

3. Give a small server breathing room with swap

With only 2 GB of RAM, a short spike can trigger the out-of-memory killer. A modest swap file is a safety net, not a performance plan. I create a swap file, set its permissions, enable it, and add it to /etc/fstab so it survives a reboot. I then check free -h and swapon --show to confirm it is present. If the server starts swapping heavily, that is a signal to fix the application or upgrade, not to keep enlarging swap.

4. Tune TCP with BBR, carefully

I enable BBR congestion control and the fq queue discipline through sysctl, then verify with sysctl net.ipv4.tcp_congestion_control. On a small server with a modest connection, this is a low-risk network tuning step, not a guarantee of speed. I measure before and after with a normal page load, rather than assuming an improvement.

5. Finish with updates and a firewall

I run unattended or regular apt updates, allow only SSH, HTTP and HTTPS through the firewall, and deny the rest by default. After each change I reboot once when I can, then verify SSH, the web service, fail2ban and swap again. A checklist that survives a reboot is worth more than a perfect first boot.

The lesson is simple: key-only SSH, automatic banning, a small swap safety net, sensible TCP tuning and a closed firewall make a small server much calmer to run.