Setting Up Your Own VPS: A Secure Starting Point

Описание и применение

Настройка защищённого VPS: обновление, создание sudo‑пользователя, настройка SSH‑ключей, UFW, автоматические обновления и защита Docker‑портов.

Задача

New VPS instances are vulnerable immediately after launch due to default configurations that allow root access, password authentication, open ports, and lack of automatic updates.

Результат

A hardened VPS ready for secure self‑hosting: patched, key‑only SSH, restricted firewall, automatic updates, and Docker port safety.

Рабочий процесс

• Log in as root and run apt update && apt upgrade -y and reboot if kernel updated.
• Create a non‑root sudo user with adduser deploy and usermod -aG sudo deploy.
• Generate an ed25519 SSH key pair locally with ssh-keygen -t ed25519 -C "you@your-machine" and copy it to the server with ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_SERVER_IP.
• Configure SSH hardening by creating /etc/ssh/sshd_config.d/99-hardening.conf with PermitRootLogin no, PasswordAuthentication no, etc., test with sshd -t and sshd -T, then reload SSH.
• Install UFW (sudo apt install -y ufw), set default deny incoming, allow outgoing, allow OpenSSH and web ports, enable UFW and verify status.
• Install and configure unattended-upgrades to apply security updates automatically, test with --dry-run.
• Optionally install fail2ban to ban repeated SSH failures.
• Address Docker firewall bypass by binding published ports to 127.0.0.1 or not publishing internal services at all.

Доказательства

Never do daily work as root. Create a sudo user and log in as that instead.

Источник

Docker bypasses UFW. When you publish a container port, Docker writes its own firewall rules that skip UFW entirely.

Источник