Setting Up Your Own VPS: A Secure Starting Point

说明与用途

安全 VPS 设置：补丁、非 root 用户、SSH 密钥硬化、UFW 防火墙、自动更新以及 Docker 端口绑定。

问题

New VPS instances are vulnerable immediately after launch due to default configurations that allow root access, password authentication, open ports, and lack of automatic updates.

结果

A hardened VPS ready for secure self‑hosting: patched, key‑only SSH, restricted firewall, automatic updates, and Docker port safety.

工作流

• Log in as root and run apt update && apt upgrade -y and reboot if kernel updated.
• Create a non‑root sudo user with adduser deploy and usermod -aG sudo deploy.
• Generate an ed25519 SSH key pair locally with ssh-keygen -t ed25519 -C "you@your-machine" and copy it to the server with ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@YOUR_SERVER_IP.
• Configure SSH hardening by creating /etc/ssh/sshd_config.d/99-hardening.conf with PermitRootLogin no, PasswordAuthentication no, etc., test with sshd -t and sshd -T, then reload SSH.
• Install UFW (sudo apt install -y ufw), set default deny incoming, allow outgoing, allow OpenSSH and web ports, enable UFW and verify status.
• Install and configure unattended-upgrades to apply security updates automatically, test with --dry-run.
• Optionally install fail2ban to ban repeated SSH failures.
• Address Docker firewall bypass by binding published ports to 127.0.0.1 or not publishing internal services at all.

证据

Never do daily work as root. Create a sudo user and log in as that instead.

来源

Docker bypasses UFW. When you publish a container port, Docker writes its own firewall rules that skip UFW entirely.

来源