firewalld basics for a Rocky or AlmaLinux VPS
Open SSH, allow a web port, close one, and survive a reboot with firewalld on Rocky or AlmaLinux. Zones explained, plus the --permanent trap.
Security & SSH
Locking down a server you can reach from anywhere: SSH keys, firewall rules, and which ports have any business being open.
Filtering by topic #security · clear
SELinux basics for a server: what it breaks
nginx returns 403 and the permissions look fine. Read the SELinux denial, fix the label with semanage and restorecon, and leave enforcing on.
SSH over a Tor onion service, no open ports
Put sshd behind a Tor onion service so the VPS answers on no inbound port. Setup, v3 client authorisation, and the exact order that avoids a lockout.
Self-host open-kritt AI security scanning
Run open-kritt on a VPS: Docker Compose setup, pinning a release, SSH tunnel to the UI on port 5173, and the provider budget to set before your first scan.
Claude Code auto mode: the new default
Auto mode becomes the Claude Code default on 14 August 2026. What each permission mode does, and which one a server you cannot watch deserves.
Is Vaultwarden Secure? A Hardening Pass
Vaultwarden encrypts every vault item in the client, so the server holds no plaintext. The real risks are your admin token and your backup file.
Claude for sysadmins: everyday server jobs
Six server jobs Claude does well: reading a failed unit's logs, drafting systemd units, reviewing nginx and Compose files, plus what you must never paste.
Vaultwarden backup and restore on a VPS
Copy a live Vaultwarden vault with sqlite3 .backup, keep the attachments, config.json and rsa_key files, then prove the restore works before you need it.
Is VPS hosting safe? What you control
A VPS separates you from other customers at the hypervisor. The real risk is your own setup: open services, reused keys, unpatched packages, leaked secrets.
Self-host Dormice for agent sandboxes
Dormice runs E2B-compatible agent sandboxes on one VPS you own. Install it, execute code in a sandbox, check the isolation, and size the host.
Numbat: watch what your AI agents do
Perplexity open sourced Numbat, an endpoint monitor that records what AI coding agents really do on your servers. What it sees, and what it cannot stop.
Keep secrets out of your AI agents
An agent holding your API keys can leak them in one tool call. Give it scoped short lived tokens behind a credential gateway, never the real keys.
Give coding agents a disposable VM
AI coding agents belong on a machine you can destroy. Blast radius, clean state per task, snapshots, and the VPS pattern that keeps it cheap.
Best self-hosted AI agents in 2026
OpenClaw, Hermes, Dify, OpenHands, and Agent Zero compared: what each agent does best, what it needs, and how to run any of them safely on your own VPS.
Run Claude Code safely on a server
Claude Code can run any command your user can. What the skip permissions flag changes, and how to contain the blast radius, from sandbox to disposable VPS.
SSH key management basics
How SSH keys work and how to manage them: one ed25519 key per device, the permissions sshd demands, config Host blocks, and revoking a lost key.
Run OpenCode on a VPS
OpenCode is the most starred open source coding agent. Install it on a VPS, run it in tmux as an unprivileged user, and keep its API key locked down.
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.
Self-signed certificates on Ubuntu, done right
Mint a self-signed TLS cert Chrome actually accepts on Ubuntu 24.04: one openssl command with SAN, nginx/Apache wiring, and trusting it without curl -k.
Self-host Dify on a VPS with Docker Compose
Six containers, so budget 4 GB of RAM. Replace every secret in .env before you boot it, then create the admin account at /install before a stranger does.
Hermes Agent hosting: a $5 VPS is enough
Hermes needs no GPU: the model runs elsewhere, so a small VPS is plenty. Run it as its own user with ProtectSystem=strict in systemd, and cover IPv6 in UFW.
Vaultwarden on a VPS: self-host passwords
Self-host a Bitwarden-compatible password manager with Vaultwarden and Docker on a VPS: HTTPS-first, admin token, Fail2ban, tested backups.
Ubuntu 24.04 unattended-upgrades: on by default?
Ubuntu Server 24.04 ships unattended-upgrades, but 20auto-upgrades turns it on. Automatic-Reboot stays false, and a dry run shows what it would install.
Install Fail2ban on Ubuntu 24.04: stop SSH bots
On Ubuntu 24.04 a plain apt install already bans SSH brute force. The fail2ban-client status sshd output proves it, plus the fix when Total failed stays at 0.
What ports are and how Linux services listen
A port is how a server sorts incoming traffic to the right service. Learn to read what is listening with ss, and tell a local port from a public one.
Webmin on Ubuntu 24.04: install and secure
Install Webmin on Ubuntu 24.04, then lock it down: SSH tunnel or IP allowlist, a real Let's Encrypt cert, two-factor, and Fail2ban on port 10000.
UFW and IPv6: the open door on your VPS
Your UFW rules and cloud firewall may only cover IPv4, leaving services wide open on IPv6. See why it happens on a VPS and how to close the gap.
UFW firewall basics: set up a VPS firewall
UFW is the simple way to run a firewall on a VPS. Set a default-deny policy, allow only the ports you need, and turn it on without locking out SSH.
SSH hardening on a VPS
Lock down SSH on your VPS: switch to key-only login, disable root and passwords with a drop-in config, and layer Fail2ban and a VPN on top.
Self-host OpenHands on a VPS
OpenHands is an AI agent that writes and runs code, so its setup needs care. Install it on a VPS with Docker and lock down the Web UI and its secrets.
Self-host Agent Zero on a VPS
Agent Zero runs code, a browser, and a shell from a Web UI, so exposing it carelessly is dangerous. Set it up on a VPS and lock the Web UI down.
Run OpenClaw safely on a VPS
OpenClaw runs shell commands and browses the web, so a careless setup is dangerous. Harden it on a VPS: unprivileged user, firewall, secrets, systemd.
First 10 minutes on a new VPS
A new VPS is a target from its first minute. This ten-minute runbook creates a user, sets SSH keys, disables root, and turns on the firewall.
Run services as an unprivileged user
Running a service as root turns one bug into full server access. Give each service its own unprivileged account, or let systemd do it with DynamicUser.
Build your own OpenClaw-style AI agent
OpenClaw is a personal AI agent that runs commands on your own server. Here is how one is built, piece by piece, and why hardening comes first.
Run Claude Code on a remote VPS with tmux
Run Claude Code on an always-on Linux VPS inside tmux so agent sessions survive a dropped SSH connection. Install, harden, and the failure modes to expect.