18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules • DevOps, Docker & Cloud VPS Deployment Mastery • Rishabh Ki Kaksha

DevOps, Docker & Cloud VPS Deployment Mastery › 18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules

45 mins

← Prev Next →

Course Syllabus

Module 1: Linux System Administration & Kernel Performance Tuning

01. Linux OS Architecture: Kernel vs User Space, System Calls & Process Management (ps, top, htop) 02. Linux File Permissions (chmod, chown, SUID/SGID) & Sticky Bits Security 03. Networking & Diagnostics: netstat, ss, lsof, tcpdump, curl, dig & DNS Resolution

Part 1: Linux & Docker Containerization

Module 2: Containerization with Docker & Multi-Stage Builds

04. Docker Architecture: Namespaces, Cgroups, UnionFS & Docker Engine Internals 05. Dockerfile Optimization: Layer Caching, Non-Root Users & Ultra-Light Alpine Multi-Stage Builds 06. Docker Compose: Multi-Container Networking, Persistent Volumes & Environment Config 07. Docker Production Security: Read-Only Root FS, Capabilities Drop & Container Scanning

Part 2: Nginx, SSL, PM2 & Automated CI/CD

Module 3: Nginx Reverse Proxy, SSL Automation & Security Hardening

08. Nginx Masterclass: Event-Driven Non-Blocking Architecture vs Apache Multi-Threaded 09. Nginx as Reverse Proxy, Load Balancer (upstream) & Gzip/Brotli Compression Config 10. SSL/TLS Automation with Certbot Let's Encrypt, HTTP/2 & Strict-Transport-Security (HSTS) 11. Nginx Rate Limiting (limit_req), DDoS Mitigation & Security Headers Injection

Module 4: Process Management with PM2 & Systemd Services

12. Systemd Services: Creating Custom System Daemons with Automatic Restart & Logging 13. PM2 Enterprise Process Manager: Cluster Mode, Ecosystem Config & Graceful Reloads 14. Log Management & Rotation: logrotate, journalctl & Centralized Syslog Streaming

Module 5: CI/CD Automation with GitHub Actions & Zero-Downtime Deployments

15. CI/CD Foundations: Building Automated Test & Build Pipelines with GitHub Actions 16. Automated SSH Deployments: Self-Hosted Runners, Deploy Keys & Zero-Downtime Atomic Symlinks 17. Blue-Green & Canary Deployment Strategies on Cloud VPS Infrastructure

Module 6: Cloud VPS Production Hardening, Firewall (UFW) & Backups

18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules 19. Automated Database & Media Backups to Cloud Storage (AWS S3 / Cloudflare R2 / MinIO) 20. Server Health Monitoring & Alerting: Uptime Kuma, Netdata, Prometheus & Telegram Bot Webhooks

Interactive Lesson Studio

# 18. Cloud VPS Hardening: Non-Root Sudo Users, SSH Key-Only Auth, Fail2ban & UFW Firewall Rules

> DevOps & Cloud VPS Notes by Rishabh - Topic 18

---

### 1. Cloud VPS Hardening Checklist 🛡️

```bash
# 1. Configure UFW Firewall:
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

# 2. Install & Configure Fail2ban (Auto-bans brute-force attacker IPs):
apt install fail2ban -y
systemctl enable --now fail2ban
```

---

### 2. Hardening `/etc/ssh/sshd_config`

```bash
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
```

---

### 3. Interview Ke 3 Sawal Is Topic Se

1. **Fail2ban attacker IP ko kaise detect aur ban karta hai?** -> `/var/log/auth.log` scan karke failed password attempts count karta hai; threshold exceed hone par `iptables`/`ufw` rule inject karke IP block karta hai.
2. **SSH port 22 ko custom port (e.g. 2222) par change karne ka kya fayda hota hai?** -> Automated script kiddie internet bot scans se 95% noise reduce hoti hai.
3. **`sudoers` file me `NOPASSWD:` kab use karna chahiye?** -> Sirf automated deployment CI/CD users ke liye specific whitelisted binaries (`/usr/bin/systemctl restart ...`) par restrict karke.

---
**Next Topic:** 19. Automated Database & Media Backups to Cloud Storage (AWS S3 / Cloudflare R2 / MinIO)

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track