Mount options that harden /tmp and /home
What nosuid, nodev and noexec really stop on a Linux VPS, the fstab and bind mount entries for /tmp, /var/tmp, /dev/shm and /home, and what breaks.
#hardening
Filtering by topic #hardening · clear
Sandbox a systemd service with ProtectSystem
ProtectSystem, PrivateTmp, DynamicUser and NoNewPrivileges explained: what each directive blocks, what it breaks, and how to debug a unit that stops starting.
Secure a new Rocky Linux server
The first hour on a Rocky Linux or AlmaLinux VPS: dnf updates, a wheel user, key only SSH, firewalld, dnf-automatic, and SELinux left enforcing.
Harden a single-node k3s cluster on a VPS
What a fresh k3s install leaves open on a VPS: port 6443, the kubelet on 10250, kubeconfig mode, NodePorts your firewall never sees, and privileged pods.
Post-Quantum SSH: What Changed on Ubuntu
OpenSSH already negotiates a post-quantum key exchange by default. Check what your Ubuntu box really uses, and learn why host keys are still classical.
Audit what commands users ran on your server
Shell history is not an audit trail. Compare sudo logging, session recording, shell hooks and auditd execve rules, then ship the logs off the box.
Is Vaultwarden Secure? A Hardening Pass
Vaultwarden encrypts every vault item in the client, so the server holds no plaintext. The real risks are your admin token and your backup file.
Keep secrets out of your AI agents
An agent holding your API keys can leak them in one tool call. Give it scoped short lived tokens behind a credential gateway, never the real keys.
Run Claude Code safely on a server
Claude Code can run any command your user can. What the skip permissions flag changes, and how to contain the blast radius, from sandbox to disposable VPS.
First 10 minutes on a new VPS
A new VPS is a target from its first minute. This ten-minute runbook creates a user, sets SSH keys, disables root, and turns on the firewall.
Run OpenClaw safely on a VPS
OpenClaw runs shell commands and browses the web, so a careless setup is dangerous. Harden it on a VPS: unprivileged user, firewall, secrets, systemd.
Self-host OpenHands on a VPS
OpenHands is an AI agent that writes and runs code, so its setup needs care. Install it on a VPS with Docker and lock down the Web UI and its secrets.
Self-host Agent Zero on a VPS
Agent Zero runs code, a browser, and a shell from a Web UI, so exposing it carelessly is dangerous. Set it up on a VPS and lock the Web UI down.
Run services as an unprivileged user
Running a service as root turns one bug into full server access. Give each service its own unprivileged account, or let systemd do it with DynamicUser.
SSH hardening on a VPS
Lock down SSH on your VPS: switch to key-only login, disable root and passwords with a drop-in config, and layer Fail2ban and a VPN on top.
Ubuntu 24.04 unattended-upgrades: on by default?
Ubuntu Server 24.04 ships unattended-upgrades, but 20auto-upgrades turns it on. Automatic-Reboot stays false, and a dry run shows what it would install.