harden-vps

Secure a new Ubuntu VPS in dependency order: create a sudo user with SSH keys and disable password and root login, enable UFW with default-deny incoming rules allowing only ports 22, 80, and 443, then add fail2ban, unattended-upgrades, and offsite backups. Always test a new SSH session before closing the current one.

Docker writes its own iptables rules, so publishing a port with docker run -p 5432:5432 exposes it publicly regardless of UFW configuration. Bind internal services to loopback with 127.0.0.1:5432:5432 or omit ports entirely and rely on the compose network, then verify externally with nmap.

Audit a running server by checking public listeners with ss -tlnp, reviewing sshd_config for PasswordAuthentication and PermitRootLogin, inspecting UFW status and Docker iptables rules, and examining last, lastb, and auth.log for suspicious logins. Each public port and running service should be individually justified.

After a suspected compromise, do not attempt to clean the server in place. Snapshot it for forensics, rotate every credential the machine held, rebuild from scratch, and restore data from tested backups, since cleaning against a competent attacker is unreliable.

Changing the SSH port only reduces log noise from scanners; it is not a real security control. Key-only authentication with ed25519 keys provides the actual protection, and placing SSH behind WireGuard or Tailscale offers stronger admin-only reachability.