{"id":619,"date":"2026-07-12T20:00:09","date_gmt":"2026-07-12T20:00:09","guid":{"rendered":"https:\/\/arkanovax.com\/blog\/?p=619"},"modified":"2026-09-25T17:52:29","modified_gmt":"2026-09-25T17:52:29","slug":"manuel-dinstallation-et-de-securisation-dun-vps-ovh","status":"publish","type":"post","link":"https:\/\/blog.arkanovax.com\/blog\/manuel-dinstallation-et-de-securisation-dun-vps-ovh\/","title":{"rendered":"Manuel d\u2019installation et de s\u00e9curisation d\u2019un VPS."},"content":{"rendered":"
\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n

1. Premi\u00e8re connexion<\/h2>\n\n\n\n

Connexion avec l\u2019utilisateur fourni par votre Host :<\/p>\n\n\n\n

ssh ubuntu@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n
Mise \u00e0 jour du syst\u00e8me :<\/p>\n\n\n\n
sudo apt update\nsudo apt full-upgrade -y\nsudo apt autoremove -y\nsudo apt autoclean\nsudo reboot\n<\/code><\/pre>\n\n\n\n
2. Cr\u00e9ation de l\u2019administrateur<\/h2>\n\n\n\n
Cr\u00e9er l\u2019utilisateur :<\/p>\n\n\n\n
sudo adduser arkan\n<\/code><\/pre>\n\n\n\n
Ajouter les droits administrateur :<\/p>\n\n\n\n
sudo usermod -aG sudo arkan\n<\/code><\/pre>\n\n\n\n
V\u00e9rifier :<\/p>\n\n\n\n
id arkan\n<\/code><\/pre>\n\n\n\n
R\u00e9sultat attendu :<\/p>\n\n\n\n
uid=1001(arkan)\ngroups=1001(arkan),27(sudo)\n<\/code><\/pre>\n\n\n\n
Tester les droits :<\/p>\n\n\n\n
su - arkan\nsudo whoami\n<\/code><\/pre>\n\n\n\n
R\u00e9sultat attendu :<\/p>\n\n\n\n
root\n<\/code><\/pre>\n\n\n\n
3. Installation de la cl\u00e9 SSH<\/h2>\n\n\n\n
Depuis Windows PowerShell, v\u00e9rifier les cl\u00e9s disponibles :<\/p>\n\n\n\n
dir $HOME\\.ssh\n<\/code><\/pre>\n\n\n\n
Afficher la cl\u00e9 publique :<\/p>\n\n\n\n
type $HOME\\.ssh\\id_ed25519.pub\n<\/code><\/pre>\n\n\n\n
Installer la cl\u00e9 sur le serveur :<\/p>\n\n\n\n
type $HOME\\.ssh\\id_ed25519.pub | ssh arkan@IP_DU_SERVEUR \"mkdir -p ~\/.ssh && chmod 700 ~\/.ssh && cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys\"\n<\/code><\/pre>\n\n\n\n
Tester la connexion :<\/p>\n\n\n\n
ssh arkan@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n
V\u00e9rifier l\u2019authentification par cl\u00e9 :<\/p>\n\n\n\n
ssh -v arkan@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n
Le r\u00e9sultat doit contenir :<\/p>\n\n\n\n
Offering public key...\nAuthenticated ... using \"publickey\"\n<\/code><\/pre>\n\n\n\n
4. Sauvegarde de la configuration SSH<\/h2>\n\n\n\n
sudo mkdir -p \/opt\/backup\/config\nsudo cp \/etc\/ssh\/sshd_config \/opt\/backup\/config\/\nsudo cp -r \/etc\/ssh\/sshd_config.d \/opt\/backup\/config\/\n<\/code><\/pre>\n\n\n\n
5. S\u00e9curisation de SSH<\/h2>\n\n\n\n
Cr\u00e9er un fichier d\u00e9di\u00e9 :<\/p>\n\n\n\n
sudo nano \/etc\/ssh\/sshd_config.d\/99-arkanov-security.conf\n<\/code><\/pre>\n\n\n\n
Ajouter :<\/p>\n\n\n\n
PermitRootLogin no\nPubkeyAuthentication yes\nPasswordAuthentication no\nPermitEmptyPasswords no\nKbdInteractiveAuthentication no\nX11Forwarding no\nMaxAuthTries 3\nLoginGraceTime 30\n<\/code><\/pre>\n\n\n\n
Ubuntu Cloud peut activer l\u2019authentification par mot de passe via :<\/p>\n\n\n\n
\/etc\/ssh\/sshd_config.d\/50-cloud-init.conf\n<\/code><\/pre>\n\n\n\n
D\u00e9sactiver cette directive :<\/p>\n\n\n\n
sudo sed -i 's\/^PasswordAuthentication yes\/#PasswordAuthentication yes\/' \/etc\/ssh\/sshd_config.d\/50-cloud-init.conf\n<\/code><\/pre>\n\n\n\n
V\u00e9rifier la configuration :<\/p>\n\n\n\n
sudo sshd -t\n<\/code><\/pre>\n\n\n\n
Red\u00e9marrer SSH :<\/p>\n\n\n\n
sudo systemctl restart ssh\n<\/code><\/pre>\n\n\n\n
Contr\u00f4ler les param\u00e8tres actifs :<\/p>\n\n\n\n
sudo sshd -T | grep -E \"permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication\"\n<\/code><\/pre>\n\n\n\n
R\u00e9sultat attendu :<\/p>\n\n\n\n
permitrootlogin no\npubkeyauthentication yes\npasswordauthentication no\nkbdinteractiveauthentication no\n<\/code><\/pre>\n\n\n\n
Conserver une session SSH ouverte pendant les tests afin d\u2019\u00e9viter tout verrouillage accidentel.<\/p>\n\n\n\n
6. Installation du pare-feu UFW<\/h2>\n\n\n\n
Installer UFW :<\/p>\n\n\n\n
sudo apt install ufw -y\n<\/code><\/pre>\n\n\n\n
D\u00e9finir les r\u00e8gles par d\u00e9faut :<\/p>\n\n\n\n
sudo ufw default deny incoming\nsudo ufw default allow outgoing\n<\/code><\/pre>\n\n\n\n
Autoriser les ports n\u00e9cessaires :<\/p>\n\n\n\n
sudo ufw allow 22\/tcp comment 'SSH'\nsudo ufw allow 80\/tcp comment 'HTTP'\nsudo ufw allow 443\/tcp comment 'HTTPS'\n<\/code><\/pre>\n\n\n\n
Activer le pare-feu :<\/p>\n\n\n\n
sudo ufw enable\n<\/code><\/pre>\n\n\n\n
V\u00e9rifier :<\/p>\n\n\n\n
sudo ufw status numbered\n<\/code><\/pre>\n\n\n\n
Remplacer la r\u00e8gle SSH par une limitation des tentatives :<\/p>\n\n\n\n
sudo ufw delete allow 22\/tcp\nsudo ufw limit 22\/tcp comment 'SSH'\n<\/code><\/pre>\n\n\n\n
Contr\u00f4ler :<\/p>\n\n\n\n
sudo ufw status verbose\n<\/code><\/pre>\n\n\n\n
Le port SSH doit appara\u00eetre avec la mention :<\/p>\n\n\n\n
LIMIT\n<\/code><\/pre>\n\n\n\n
7. Installation de Fail2ban<\/h2>\n\n\n\n
Installer Fail2ban :<\/p>\n\n\n\n
sudo apt install fail2ban -y\n<\/code><\/pre>\n\n\n\n
Cr\u00e9er la configuration :<\/p>\n\n\n\n
sudo nano \/etc\/fail2ban\/jail.local\n<\/code><\/pre>\n\n\n\n
Contenu recommand\u00e9 :<\/p>\n\n\n\n
[DEFAULT]\nbackend = systemd\nbantime = 24h\nfindtime = 10m\nmaxretry = 5\nbanaction = ufw\nignoreip = 127.0.0.1\/8 ::1<\/code><\/pre>\n\n\n
[sshd]<\/p>\n\n\n\n
enabled = true<\/p>\n\n\n\n
Tester la configuration :<\/p>\n\n\n\n
sudo fail2ban-client -t\n<\/code><\/pre>\n\n\n\n
R\u00e9sultat attendu :<\/p>\n\n\n\n
OK\n<\/code><\/pre>\n\n\n\n
Red\u00e9marrer Fail2ban :<\/p>\n\n\n\n
sudo systemctl restart fail2ban\n<\/code><\/pre>\n\n\n\n
V\u00e9rifier le service :<\/p>\n\n\n\n
sudo systemctl status fail2ban --no-pager\n<\/code><\/pre>\n\n\n\n
Afficher les jails actives :<\/p>\n\n\n\n
sudo fail2ban-client status\n<\/code><\/pre>\n\n\n\n
Contr\u00f4ler la protection SSH :<\/p>\n\n\n\n
sudo fail2ban-client status sshd\n<\/code><\/pre>\n\n\n\n
\u00c9tat final du serveur<\/h2>\n\n\n\n
Le VPS dispose maintenant de :<\/p>\n\n\n\n