Overview

A freshly installed Pod is reachable from the whole internet, so a few quick steps dramatically reduce your attack surface. This article covers the essential hardening tasks to run right after you install your operating system.

Before you begin

• A running Pod with SSH access.
• Your SSH public key already added.
• Ten minutes and root (or sudo) access.

Steps

1. Update everything first

```bash

Debian/Ubuntu

apt update && apt full-upgrade -y

RHEL family

dnf -y upgrade ```

2. Create a non-root sudo user

bash adduser deploy usermod -aG sudo deploy # Debian/Ubuntu usermod -aG wheel deploy # RHEL family

Test that you can log in as deploy before disabling root — keep your root session open as a safety net.

3. Use SSH keys and disable passwords

In /etc/ssh/sshd_config (or a drop-in under /etc/ssh/sshd_config.d/):

PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes

Then reload:

bash systemctl reload ssh # or sshd on RHEL

4. Configure a firewall

```bash

Ubuntu (ufw)

ufw default deny incoming ufw default allow outgoing ufw allow OpenSSH ufw --force enable

RHEL (firewalld)

systemctl enable --now firewalld firewall-cmd --permanent --add-service=ssh firewall-cmd --reload ```

5. Install fail2ban (optional but recommended)

bash apt install -y fail2ban systemctl enable --now fail2ban

6. Enable unattended security updates

• Debian/Ubuntu: apt install -y unattended-upgrades
• RHEL family: dnf install -y dnf-automatic && systemctl enable --now dnf-automatic.timer

Ongoing hygiene

• Remove software you do not use.
• Keep a snapshot before major changes and off-box backups for data.
• Review journalctl and auth logs periodically.

Troubleshooting

• Problem: locked out after disabling root/password login. Solution: use the console VNC or rescue mode to revert the sshd config.
• Problem: firewall blocks your app. Solution: open the specific port rather than disabling the firewall.
• Problem: fail2ban bans your own IP. Solution: unban with fail2ban-client set sshd unbanip <IP> and whitelist your address.

Related articles

• [Changing the SSH port and disabling root login]
• [Managing users and sudo access]
• [Setting the timezone and configuring NTP]