Don’t trust the config: 6 tests that prove your self‑hosted AI agent server is locked down

Description and use

Run six tests to confirm your VPS with an AI agent is locked down: only port 22 is open, SSH password login is disabled, fail2ban is active, the agent auto‑restarts, alerts work, and API key limits are verified.

Problem

Self‑hosted AI agents often appear secure in config files but may expose ports, allow password logins, or lack fail2ban protection.

Outcome

After applying the six tests, the VPS is confirmed to expose only SSH, enforce key‑based authentication, actively ban attackers, automatically recover the agent, and provide verified alerts and API key limits.

Workflow

• 1. Scan the VPS from an external machine using nmap to ensure only port 22 is open.
• 2. Verify SSH daemon settings with sshd -T and test password authentication from outside.
• 3. Trigger fail2ban by failing SSH logins and confirm the attacker IP is banned.
• 4. Kill the agent’s user‑systemd service, observe automatic restart and Telegram response timing.
• 5. Stop the agent service and confirm an alert message is received via Telegram within minutes.
• 6. Query the API key endpoint (e.g., OpenRouter) to check spending limits and reset times.

Evidence

From another machine, not the server itself and not localhost: nmap -Pn -p- -sS YOUR_IP nmap -Pn -sU --top-ports 100 YOUR_IP

Source

sudo sshd -T | grep -Ei 'passwordauthentication|kbdinteractiveauthentication|permitrootlogin'

Source

sudo fail2ban-client status sshd

Source

curl -s https://openrouter.ai/api/v1/key -H "Authorization: Bearer $KEY"

Source