Your VPN Server Is a Target for Bots: Here’s How To Hide It

You’ve set up a personal VPN server for the first time, maybe even based on Amnezia Hosting. Everything works — you not only connect yourself but also hand out access to the secure tunnel to friends and relatives.

But protection at this stage is still imperfect. A VPN secures your data “in transit,” but your server is most likely still visible to cybercriminals and botnet scanners.

In this article, we’ll work through basic protection for your server, using a medieval castle as an example.

We’re giving out birthday gifts — visit our site all through October and win prizes!

TL;DR

A VPN protects data in transit, but the server itself can be seen by bots: 40% of internet traffic in 2026 is automated bots that knock on standard ports (22/SSH) and brute-force passwords.
Hosting providers like Amnezia Hosting are responsible for the “hardware” and isolation, while passwords, settings, and open ports inside the server are the user’s own responsibility.
Server management goes through an SSH terminal (ssh user@ip -p port); instructions for opening the terminal are given for Windows, macOS, Linux, Android (Termux), and iOS (Termius/Blink Shell).
Basic protection in four steps: enable automatic updates (unattended-upgrades) → create a separate user with sudo rights and a strong password (longer than 14 characters) → disable root login (PermitRootLogin no) → change the standard SSH port (to a number from 1024 to 65535).
For Ubuntu 22.04/24.04, the port is changed separately through ssh.socket, with a mandatory empty ListenStream= line.
After the changes, you need to update the connection details in the Amnezia VPN app — new IP, port, login, password — and synchronize the server.

Bots Are Hunting for Your Server

Internet attackers aren’t just teenagers in hoodies. More precisely, mostly not. According to the Thales corporation’s 2026 data, 40% of internet traffic is created by automated bots that belong to cybercriminals.

These bots probe open ports, such as the standard port 22 for SSH, on every IP address in the world.

They don’t care what task your server performs

Their goal is to find any crack in a network node’s defenses. To find weak spots, bots guess passwords at random or use ready-made scripts — called exploits — to seize control.

Where the Hosting Provider’s Responsibility Ends

Any hosting provider is the foundation of your server. With Amnezia Hosting, for example, we build and protect the “fortress” itself — the walls, the moat, the gates. Our job is to provide optimal “hardware” and the necessary communication channels, and to isolate users from one another at the infrastructure level.

Everything that happens inside the server is determined by you and your settings. Passwords, app settings, and open ports are the guards’ rules, the watch schedule, and the service entrances. We build the fortress walls, but you decide which doors are locked and for whom they open.

Before building walls and setting traps, it’s worth learning how to log in to your server. If you’ve already set up your own VPS, this won’t be a problem for you.

Speaking the Server’s Language: Working with the Terminal

Most servers are managed through the SSH protocol — it’s the most secure way of “communicating” with your VPS, which is why it’s considered the standard.

How to Open the Terminal

Windows. Use the command line. Press Win+R, type cmd, and press Enter.
macOS. The terminal is built into the system. Call it up with the Command+Space key combination and type the word “Terminal.”
Linux (Ubuntu, Fedora, Debian). A built-in Terminal, as on macOS. Open the main applications menu and type the word Terminal.

If you want to manage the server remotely, there are options for mobile devices.

Android. We recommend installing the Termux app. It’s a full-fledged terminal emulator that lets you work with the server just like on a computer.
iOS. Apple mobile devices don’t have a built-in terminal. You’ll need a dedicated SSH client app. The most popular and reliable are Termius and Blink Shell.

Connecting to the Server

First, let’s figure out how to copy a command and paste it into the terminal. The standard Ctrl+V often doesn’t work. To paste text into the terminal, use the right-click context menu or the Ctrl+Shift+V combination. If you need to copy something from the terminal, press Ctrl+Shift+C.

To establish a connection, use the universal command:

ssh user@ip-address -p port_number

So, if you’re working under the root account with IP 1.2.3.4 through port 22, copy and paste the line ssh root@1.2.3.4 -p 22 into the terminal

On the first connection, the terminal will ask: Are you sure you want to continue connecting (yes/no)? Type “yes” and press Enter.

Important: when you enter a password in the terminal, it isn’t displayed, not even as asterisks or dots, so that no one can learn its length. Enter the password blindly and press Enter

How to Protect the Server

Here are a few simple steps that will make your digital stronghold safer.

Setting Up Automatic Updates

Why? So the system closes vulnerabilities on its own, without your involvement.

How? Enter two commands in the terminal:

sudo apt update && sudo apt install unattended-upgrades -y

sudo dpkg-reconfigure --priority=low unattended-upgrades

After the second command, click Yes in the window that appears. Congratulations, your server will download and install critical security patches on its own.

Creating a Separate User

Why? By default, bots check common account names and passwords, including root access to the server.

How? We create a new user for access to the VPS. To do this, type into the terminal:

adduser novice

Instead of novice, enter your own username

The system will ask you to enter and confirm a new password, and will also offer to fill in personal information. You can skip the personal information by pressing Enter.

Important: create a strong password of 14 characters or more for the new account. Include letters (A–Z), digits (0–9), and special characters (!@#$%^&*).

Names, dates, ordinary words, or predictable substitutions are vulnerable to dictionary attacks!

usermod -aG sudo novice

Done — your new user can run any system commands.

Write the rule into a separate sudo configuration file, so the user novice can run any commands through sudo without entering a password.

echo “novice ALL=(ALL) NOPASSWD:ALL” > /etc/sudoers.d/novice

To use the new account with full rights, switch to it and fully load its environment — variables, home directory, and profile. For the user novice, the command looks like this:

su - novice

Disabling the “Master Key”

Why? So bots can’t guess the root password.

How? We disable login for the main account.

Important: after the actions in this section, logging in to the VPS through root will be unavailable. The administrator will be the user you created earlier and gave the necessary rights

So, your new account is ready and you’ve checked that you can run commands as the administrator. To disable root login, edit the SSH configuration file with the command:

sudo nano /etc/ssh/sshd_config

Find the PermitRootLogin line and change it to: PermitRootLogin no.

If there’s a hash symbol # before the line, delete it — it marks a comment in the code.

Save the file — Ctrl+O and Enter to apply the changes, then Ctrl+X to exit the file — and restart the service:

sudo systemctl restart ssh

Changing the Standard Port

Why? So most automated bots can’t find you. If the standard port 22 is the castle’s main gate, then changing the port is moving the entrance to a secret tunnel that no one knows about but you.

How? Open the SSH server config file you already know:

sudo nano /etc/ssh/sshd_config

Find the #Port 22 line, delete the hash symbol #, and specify the new port: Port 42069. Instead of 42069, any number in the range from 1024 to 65535 that isn’t taken by other services will do. Save the file: Ctrl+O and Enter to apply the changes, then Ctrl+X to exit the file.

Restart the services:

sudo systemctl restart ssh

Check that the server really sees the new port:

sudo ss -tlnp | grep -E ‘:(22|42069)\s’

If it worked, you’ll see a message like:

LISTEN 0 128 0.0.0.0:42069 0.0.0.0:* users:((“sshd”,pid=1234,fd=3))

Important: don’t close the current session! Open a new terminal window and check the connection on the new port — that way you definitely won’t lose access to the server

To connect to the server, use this command:

ssh novice@SERVER_IP -p 42069

For Ubuntu 22.04 and 24.04

These versions of Linux may ignore the changes in the sshd_config file and keep the standard port 22. To get around this limitation, first check whether activation through the SSH socket (a data-exchange interface) is enabled:

systemctl is-enabled ssh.socket

If you get enabled in response, then you need to change the port in the socket. To do this, type into the terminal:

sudo systemctl edit ssh.socket

A text editor will open. In the free area between the comments, add the following block:

[Socket]
ListenStream=
ListenStream=42069

Important: the empty ListenStream= line is critical. It tells the system to forget the standard port 22. Without it, your server will listen on both ports at once, and the trick won’t work

Save the file — Ctrl+O and Enter to apply the changes, then Ctrl+X to exit the file.

For the changes to take effect, run two commands:

sudo systemctl daemon-reload

sudo systemctl restart ssh.socket

daemon-reload — tells the system that we’ve changed the configuration files and they need to be reread.
restart ssh.socket — restarts the service responsible for listening for incoming connections on the new port.

Let’s check the result. Enter the command:

sudo ss -tulpn | grep ssh

It shows which ports your server is “listening” on. A line with the new port 42069 should appear in the output.

The Last Bastion: Synchronization with the Amnezia VPN App

When you’re done with the server itself, update the details in the Amnezia VPN app. It needs to learn that we’ve changed the ports and access parameters in order to establish a stable connection.

Create a new connection with the updated details: IP address and port, username, password. The “+” icon → “VPN on your own server.” For example, IP:1.2.3.4:42069, username: novice, password: your_new_password.
Skip the setup at the “Choose Installation Type” stage.
Click the ⚙️ (gear) icon and select the server in the “Servers” section.
Go to the “Management” tab and select “Check the server for previously installed Amnezia services.”

After the check, the protocols and services found on the server will be added to the app automatically.

Important: if you’re going to reinstall or reconfigure Amnezia VPN, first follow the protection recommendations, and then set up your own VPN. In that case, you can skip the synchronization section

Server Security Is a Joint Effort

Amnezia Hosting is a solid foundation and a set of universal tools for your digital fortress. But you control the keys inside that fortress.

We’re always ready to help: the Amnezia Hosting Wiki has settings for every level of protection — from firewalls to protection against password brute-forcing.