How To Secure A Linux VPS For Your Game Server

A new VPS is a blank server connected to the internet. Within minutes, automated bots begin trying to log in with common passwords. Basic security takes about half an hour and prevents most of the problems game server owners run into. This guide shows the essential steps on a Debian or Ubuntu server, with commands you can copy.

Before you start: keep one SSH session open while you make changes, and test new logins in a second window. Mistakes with SSH or the firewall can lock you out.

1. Update The System

sudo apt update && sudo apt upgrade -y

Do this first, and repeat regularly. Many attacks use known bugs that updates have already fixed.

2. Create A Normal User

Do not run your game server as root. If the game server or a plugin is ever compromised, a normal user limits the damage.

sudo adduser gameadmin
sudo usermod -aG sudo gameadmin

Use a separate user, for example minecraft or rust, to run the game server process itself.

3. Use SSH Keys Instead Of Passwords

On your own computer, create a key pair and copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id gameadmin@YOUR_SERVER_IP

Test that you can log in with the key in a new window. Only then edit /etc/ssh/sshd_config and set:

PermitRootLogin no
PasswordAuthentication no

Restart the SSH service afterwards with sudo systemctl restart ssh. Keep your private key safe and back it up.

4. Set Up A Firewall

A firewall allows only the traffic you choose. With UFW, allow SSH first, and then your game's port. For example, for a Minecraft server:

sudo ufw allow OpenSSH
sudo ufw allow 25565/tcp
sudo ufw enable
sudo ufw status

Common game ports are 30120 (FiveM and RedM, TCP and UDP), 28015 (Rust, UDP) and 25565 (Minecraft Java, TCP). Do not open database ports to the internet. If you need to reach admin tools such as txAdmin or RCON, restrict them to your own IP:

sudo ufw allow from YOUR_HOME_IP to any port 40120 proto tcp

5. Add Fail2ban

Fail2ban watches login attempts and temporarily blocks addresses that keep failing.

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

The default settings protect SSH. You can tune the ban time and number of attempts in its configuration.

6. Turn On Automatic Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

This installs important security patches automatically. Restart the machine when a kernel update needs it.

7. Secure The Database And Admin Tools

• Run MariaDB or MySQL so that it only listens on the local machine, unless you truly need remote access.
• Use a separate database user for each game server, with a strong, unique password.
• Keep txAdmin, RCON and any web panels behind the firewall, with strong passwords.
• Do not reuse passwords between services.

8. Back Up

Security includes recovering from mistakes. Keep regular backups of your world, database and configuration, and store a copy away from the server. Test restoring at least once. A backup you have never restored is only a hope.

9. Review Your Logs

Check /var/log/auth.log now and then to see login attempts, and check your game server's logs after restarts. Odd entries are often the first sign of a problem.

What Security Cannot Stop

These steps protect against break-ins, but they cannot stop a large DDoS attack, because that traffic fills your network link before it reaches the machine. For that, you need protection in the network in front of your server. Read How DDoS Protection Works for Game Servers and What Is a DDoS Attack on a Game Server?

Ready To Host?

Linceris.com VPS packages come with DataForest.net DDoS protection, so you can focus on securing the server itself. New to servers? Start with What Is a VPS?