Don’t trust the config: 6 tests that prove your self‑hosted AI agent server is locked down

Описание и применение

Проведите шесть тестов, чтобы убедиться, что ваш VPS с AI‑агентом защищён: только порт 22 открыт, парольный доступ SSH запрещён, fail2ban активен, агент автоматически восстанавливается, уведомления работают, и лимиты ключа проверены.

Задача

Self‑hosted AI agents often appear secure in config files but may expose ports, allow password logins, or lack fail2ban protection.

Результат

After applying the six tests, the VPS is confirmed to expose only SSH, enforce key‑based authentication, actively ban attackers, automatically recover the agent, and provide verified alerts and API key limits.

Рабочий процесс

• 1. Scan the VPS from an external machine using nmap to ensure only port 22 is open.
• 2. Verify SSH daemon settings with sshd -T and test password authentication from outside.
• 3. Trigger fail2ban by failing SSH logins and confirm the attacker IP is banned.
• 4. Kill the agent’s user‑systemd service, observe automatic restart and Telegram response timing.
• 5. Stop the agent service and confirm an alert message is received via Telegram within minutes.
• 6. Query the API key endpoint (e.g., OpenRouter) to check spending limits and reset times.

Доказательства

From another machine, not the server itself and not localhost: nmap -Pn -p- -sS YOUR_IP nmap -Pn -sU --top-ports 100 YOUR_IP

Источник

sudo sshd -T | grep -Ei 'passwordauthentication|kbdinteractiveauthentication|permitrootlogin'

Источник

sudo fail2ban-client status sshd

Источник

curl -s https://openrouter.ai/api/v1/key -H "Authorization: Bearer $KEY"

Источник