Don’t trust the config: 6 tests that prove your self‑hosted AI agent server is locked down

说明与用途

执行六个测试，确保您的 VPS 上的 AI 代理已被锁定：仅开放端口 22，禁用 SSH 密码登录，启用 fail2ban，代理自动重启，警报正常工作，并验证 API 密钥限制。

问题

Self‑hosted AI agents often appear secure in config files but may expose ports, allow password logins, or lack fail2ban protection.

结果

After applying the six tests, the VPS is confirmed to expose only SSH, enforce key‑based authentication, actively ban attackers, automatically recover the agent, and provide verified alerts and API key limits.

工作流

• 1. Scan the VPS from an external machine using nmap to ensure only port 22 is open.
• 2. Verify SSH daemon settings with sshd -T and test password authentication from outside.
• 3. Trigger fail2ban by failing SSH logins and confirm the attacker IP is banned.
• 4. Kill the agent’s user‑systemd service, observe automatic restart and Telegram response timing.
• 5. Stop the agent service and confirm an alert message is received via Telegram within minutes.
• 6. Query the API key endpoint (e.g., OpenRouter) to check spending limits and reset times.

证据

From another machine, not the server itself and not localhost: nmap -Pn -p- -sS YOUR_IP nmap -Pn -sU --top-ports 100 YOUR_IP

来源

sudo sshd -T | grep -Ei 'passwordauthentication|kbdinteractiveauthentication|permitrootlogin'

来源

sudo fail2ban-client status sshd

来源

curl -s https://openrouter.ai/api/v1/key -H "Authorization: Bearer $KEY"

来源