Blog › Security
Security · 12 min read

Zero-Trust Security for Cloud Instances: A Practical Checklist

VH
VeloxaHost team ·March 6, 2025 ·12 min read

Every instance on VeloxaHost starts hardened at the infrastructure level — unprivileged containers, restricted project modes, and port isolation between servers. Network traffic, however, is allowed by default until you attach a firewall (only outbound TCP port 25 is blocked). And defense in depth means adding your own security layers too. Here's a complete checklist.

⚠️

Security hardening should be done before your application goes live. Retrofitting security on a running production system is much harder.

1. SSH Key-Only Authentication

Disable password authentication immediately after deploying:

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
MaxAuthTries 3

Then restart SSH: sudo systemctl restart sshd. From this point, only users with a valid private key can log in.

VeloxaHost servers are reached as root (ssh -p <port> root@<shared-ip>), so before setting PermitRootLogin no, create a sudo user with your key and check you can log in as that user. Keep sshd on port 22: the first port of your server's block on the shared IPv4 address forwards to port 22, so moving sshd to another port breaks SSH over the shared address.

2. Firewall Rules via VeloxaHost Console

Use Firewalls → New Firewall in the VeloxaHost console to create a policy with the principle of least privilege, then attach it on the server's page:

  • Allow SSH (22) from your office/VPN IP only — never 0.0.0.0/0
  • Allow 80/443 from anywhere for web-facing services
  • Drop everything else — once the firewall is attached, inbound traffic that no rule allows is dropped; outbound stays allowed unless you add drop rules

3. fail2ban — Brute Force Protection

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit /etc/fail2ban/jail.local and set:

[sshd]
enabled  = true
maxretry = 5
bantime  = 1h
findtime = 10m
sudo systemctl enable --now fail2ban

4. Automatic Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

This automatically installs security patches daily. Critical CVEs get patched without you needing to remember to run apt upgrade.

5. Audit Logging

Every SSH login, sudo command, and file write on a production instance should be logged:

sudo apt install auditd -y
sudo systemctl enable --now auditd

Forward logs to your centralized logging system (Loki, CloudWatch, Datadog) so they're preserved even if the instance is compromised.

Checklist Summary

  • ✅ SSH key-only — no passwords, no root login
  • ✅ Firewall — allowlist, not blocklist
  • ✅ fail2ban — auto-ban brute-force IPs
  • ✅ unattended-upgrades — auto security patches
  • ✅ auditd — every privileged action logged
  • ✅ VeloxaHost Alerts — CPU/mem/disk/status alert rules for anomaly detection