{"id":619,"date":"2026-08-07T20:00:09","date_gmt":"2026-08-07T20:00:09","guid":{"rendered":"https:\/\/arkanovax.com\/blog\/?p=619"},"modified":"2026-08-15T00:09:58","modified_gmt":"2026-08-15T00:09:58","slug":"manuel-dinstallation-et-de-securisation-dun-vps-ovh","status":"publish","type":"post","link":"https:\/\/arkanovax.com\/blog\/manuel-dinstallation-et-de-securisation-dun-vps-ovh\/","title":{"rendered":"Manuel d\u2019installation et de s\u00e9curisation d\u2019un VPS."},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">1. Premi\u00e8re connexion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Connexion avec l\u2019utilisateur fourni par votre Host :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh ubuntu@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Mise \u00e0 jour du syst\u00e8me :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt full-upgrade -y\nsudo apt autoremove -y\nsudo apt autoclean\nsudo reboot\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">2. Cr\u00e9ation de l\u2019administrateur<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cr\u00e9er l\u2019utilisateur :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo adduser arkan\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ajouter les droits administrateur :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo usermod -aG sudo arkan\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9rifier :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>id arkan\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">R\u00e9sultat attendu :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>uid=1001(arkan)\ngroups=1001(arkan),27(sudo)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Tester les droits :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>su - arkan\nsudo whoami\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">R\u00e9sultat attendu :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>root\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">3. Installation de la cl\u00e9 SSH<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Depuis Windows PowerShell, v\u00e9rifier les cl\u00e9s disponibles :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dir $HOME\\.ssh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Afficher la cl\u00e9 publique :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>type $HOME\\.ssh\\id_ed25519.pub\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Installer la cl\u00e9 sur le serveur :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>type $HOME\\.ssh\\id_ed25519.pub | ssh arkan@IP_DU_SERVEUR \"mkdir -p ~\/.ssh &amp;&amp; chmod 700 ~\/.ssh &amp;&amp; cat >> ~\/.ssh\/authorized_keys &amp;&amp; chmod 600 ~\/.ssh\/authorized_keys\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Tester la connexion :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh arkan@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9rifier l\u2019authentification par cl\u00e9 :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -v arkan@IP_DU_SERVEUR\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Le r\u00e9sultat doit contenir :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Offering public key...\nAuthenticated ... using \"publickey\"\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">4. Sauvegarde de la configuration SSH<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo mkdir -p \/opt\/backup\/config\nsudo cp \/etc\/ssh\/sshd_config \/opt\/backup\/config\/\nsudo cp -r \/etc\/ssh\/sshd_config.d \/opt\/backup\/config\/\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">5. S\u00e9curisation de SSH<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cr\u00e9er un fichier d\u00e9di\u00e9 :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/ssh\/sshd_config.d\/99-arkanov-security.conf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ajouter :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PermitRootLogin no\nPubkeyAuthentication yes\nPasswordAuthentication no\nPermitEmptyPasswords no\nKbdInteractiveAuthentication no\nX11Forwarding no\nMaxAuthTries 3\nLoginGraceTime 30\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu Cloud peut activer l\u2019authentification par mot de passe via :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/ssh\/sshd_config.d\/50-cloud-init.conf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">D\u00e9sactiver cette directive :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sed -i 's\/^PasswordAuthentication yes\/#PasswordAuthentication yes\/' \/etc\/ssh\/sshd_config.d\/50-cloud-init.conf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9rifier la configuration :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sshd -t\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Red\u00e9marrer SSH :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart ssh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Contr\u00f4ler les param\u00e8tres actifs :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sshd -T | grep -E \"permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">R\u00e9sultat attendu :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>permitrootlogin no\npubkeyauthentication yes\npasswordauthentication no\nkbdinteractiveauthentication no\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Conserver une session SSH ouverte pendant les tests afin d\u2019\u00e9viter tout verrouillage accidentel.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Installation du pare-feu UFW<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Installer UFW :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install ufw -y\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">D\u00e9finir les r\u00e8gles par d\u00e9faut :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw default deny incoming\nsudo ufw default allow outgoing\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Autoriser les ports n\u00e9cessaires :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow 22\/tcp comment 'SSH'\nsudo ufw allow 80\/tcp comment 'HTTP'\nsudo ufw allow 443\/tcp comment 'HTTPS'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Activer le pare-feu :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw enable\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9rifier :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw status numbered\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remplacer la r\u00e8gle SSH par une limitation des tentatives :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw delete allow 22\/tcp\nsudo ufw limit 22\/tcp comment 'SSH'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Contr\u00f4ler :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw status verbose\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Le port SSH doit appara\u00eetre avec la mention :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LIMIT\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">7. Installation de Fail2ban<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Installer Fail2ban :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install fail2ban -y\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cr\u00e9er la configuration :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/fail2ban\/jail.local\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Contenu recommand\u00e9 :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;DEFAULT]\nbackend = systemd\nbantime = 24h\nfindtime = 10m\nmaxretry = 5\nbanaction = ufw\nignoreip = 127.0.0.1\/8 ::1<\/code><\/pre>\n\n\n<p>[sshd]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">enabled = true<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tester la configuration :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client -t\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">R\u00e9sultat attendu :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Red\u00e9marrer Fail2ban :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart fail2ban\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00e9rifier le service :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl status fail2ban --no-pager\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Afficher les jails actives :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client status\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Contr\u00f4ler la protection SSH :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo fail2ban-client status sshd\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u00c9tat final du serveur<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Le VPS dispose maintenant de :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ubuntu 26.04 LTS \u00e0 jour ;<\/li>\n\n\n\n<li>un utilisateur administrateur d\u00e9di\u00e9 : <code>arkanov<\/code> ;<\/li>\n\n\n\n<li>une authentification SSH par cl\u00e9 ED25519 ;<\/li>\n\n\n\n<li>une connexion directe de <code>root<\/code> d\u00e9sactiv\u00e9e ;<\/li>\n\n\n\n<li>une authentification SSH par mot de passe d\u00e9sactiv\u00e9e ;<\/li>\n\n\n\n<li>une sauvegarde de la configuration SSH ;<\/li>\n\n\n\n<li>un pare-feu UFW actif ;<\/li>\n\n\n\n<li>une politique entrante par d\u00e9faut en <code>deny<\/code> ;<\/li>\n\n\n\n<li>SSH limit\u00e9 par UFW ;<\/li>\n\n\n\n<li>HTTP et HTTPS autoris\u00e9s ;<\/li>\n\n\n\n<li>Fail2ban configur\u00e9 pour prot\u00e9ger SSH ;<\/li>\n\n\n\n<li>un bannissement de 24 heures apr\u00e8s 5 \u00e9checs en 10 minutes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Architecture pr\u00e9vue<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Ubuntu Server 26.04 LTS\n\u2502\n\u251c\u2500\u2500 UFW\n\u251c\u2500\u2500 Fail2ban\n\u251c\u2500\u2500 Docker Engine\n\u251c\u2500\u2500 Dockge\n\u251c\u2500\u2500 Nginx Proxy Manager\n\u251c\u2500\u2500 Ollama\n\u251c\u2500\u2500 Open WebUI\n\u251c\u2500\u2500 n8n\n\u251c\u2500\u2500 MariaDB\n\u251c\u2500\u2500 Beszel\n\u2514\u2500\u2500 Uptime Kuma\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Sauvegardes recommand\u00e9es<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Conserver r\u00e9guli\u00e8rement une copie des r\u00e9pertoires suivants :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/ssh\/\n\/etc\/fail2ban\/\n\/etc\/ufw\/\n\/opt\/backup\/config\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ces sauvegardes permettront de restaurer rapidement la configuration de s\u00e9curit\u00e9 lors d\u2019une reconstruction ou d\u2019un remplacement du VPS.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Premi\u00e8re connexion Connexion avec l\u2019utilisateur fourni par votre Host : Mise \u00e0 jour du syst\u00e8me : 2. Cr\u00e9ation de l\u2019administrateur Cr\u00e9er l\u2019utilisateur : Ajouter les droits administrateur : V\u00e9rifier : R\u00e9sultat attendu : Tester les droits : R\u00e9sultat attendu : 3. Installation de la cl\u00e9 SSH Depuis Windows PowerShell, v\u00e9rifier les cl\u00e9s disponibles :\u2026 <span class=\"read-more\"><a href=\"https:\/\/arkanovax.com\/blog\/manuel-dinstallation-et-de-securisation-dun-vps-ovh\/\">Read More: Manuel d\u2019installation et de s\u00e9curisation d\u2019un VPS. &raquo;<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[53],"tags":[55],"class_list":["post-619","post","type-post","status-publish","format-standard","hentry","category-vps","tag-vps"],"_links":{"self":[{"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/posts\/619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/comments?post=619"}],"version-history":[{"count":4,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/posts\/619\/revisions"}],"predecessor-version":[{"id":673,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/posts\/619\/revisions\/673"}],"wp:attachment":[{"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/media?parent=619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/categories?post=619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/arkanovax.com\/blog\/wp-json\/wp\/v2\/tags?post=619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}