Overview

A new Pod is a clean server that you are responsible for securing. This article is a practical baseline checklist you can apply to any Linux CPU Pod to reduce your attack surface.

Before you begin

• Root or sudo access to your Pod, and access to the ALYPOD Console.
• A recent snapshot of the Pod, so you can roll back if a change breaks access.

Steps

1. Log in over SSH keys, not passwords. Disable password authentication and root login in /etc/ssh/sshd_config, then restart SSH. See Hardening SSH.
2. Seal the firewall. Allow only the ports you actually use (SSH, HTTP/HTTPS). With UFW:

bash sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow 22/tcp sudo ufw allow 80,443/tcp sudo ufw enable

1. Install security updates regularly and enable unattended upgrades. See Keeping your server patched.
2. Add Fail2ban to block brute-force attempts automatically. See Installing and configuring Fail2ban.
3. Create a non-root admin user and use sudo for privileged work:

bash sudo adduser alypod sudo usermod -aG sudo alypod

1. Remove what you do not need. Uninstall unused packages and close unused services:

bash ss -tulpn sudo systemctl disable --now <service>

1. Keep secrets off the disk where possible, use strong unique passwords, and store keys in an SSH agent.
2. Back up regularly. Use snapshots and/or a Storage Box, and test that restores actually work.
3. Watch your logs and review logins periodically. See Auditing logins and access.

Troubleshooting

• Problem: You locked yourself out of SSH. Solution: Use the VNC console in the ALYPOD Console to restore the previous sshd_config or firewall rules.
• Problem: An application stopped working after enabling UFW. Solution: Run sudo ufw status numbered and re-open the required port.

Related articles

• [Hardening SSH]
• [Installing and configuring Fail2ban]
• [Keeping your server patched]