Essential VPS security practices every SaaS founder must know. Learn about firewalls, user management, fail2ban, and keeping your AI assistant server secure.

14 min read

VPS Security 101 - Essential Practices for SaaS Founders

Running an AI assistant on a VPS means your server is connected to the internet 24/7. This chapter covers the essential security practices every SaaS founder must implement to protect their VPS from common attacks. These fundamentals will keep your server and your AI assistant safe.

The Security Mindset

Before diving into specific configurations, understand the security landscape:

Why VPS servers get attacked:

  • Automated bots constantly scan the internet for vulnerable servers
  • Default configurations are well-known and exploited immediately
  • Cryptocurrency miners want free compute resources
  • Spammers look for relay servers
  • Data thieves want any information they can sell

The good news: Most attacks are automated and unsophisticated. Basic security measures block 99% of threats.

Core principles:

  1. Minimize attack surface - Disable everything you do not need
  2. Defense in depth - Multiple layers of protection
  3. Keep software updated - Patch vulnerabilities promptly
  4. Monitor and log - Detect problems early
  5. Principle of least privilege - Users get minimum necessary access

1. Keep Your System Updated

The single most important security measure is keeping your software current. Vulnerabilities are discovered constantly, and updates patch them.

Automatic Updates (Already Configured)

If you followed the quick setup guide, you already have unattended-upgrades configured. Verify it is working:

# Check the service status
sudo systemctl status unattended-upgrades

# View recent upgrade logs
cat /var/log/unattended-upgrades/unattended-upgrades.log

Manual Update Checks

Even with automatic updates, periodically check manually:

# Update package lists
sudo apt update

# See what would be upgraded
apt list --upgradable

# Apply all upgrades
sudo apt upgrade -y

# Remove unnecessary packages
sudo apt autoremove -y

Set a Schedule

Make it a habit:

  • Weekly: Quick check for pending updates
  • Monthly: Full system update and cleanup
  • Quarterly: Review and update security policies

2. Firewall Configuration Review

Your firewall is the first line of defense. Let us review and optimize it.

Verify UFW Status

sudo ufw status verbose

You should see something like:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
2222/tcp                   ALLOW IN    Anywhere
18789/tcp                  ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere

Firewall Best Practices

Only open ports you absolutely need:

Port Service Should Be Open?
22 or custom SSH Yes, but restrict if possible
80 HTTP Only if running web server
443 HTTPS Only if running web server with SSL
18789 OpenClaw Only when running OpenClaw
18800 PicoClaw Only when running PicoClaw

Remove unnecessary rules:

# List numbered rules
sudo ufw status numbered

# Delete a rule by number (example: deleting rule 3)
sudo ufw delete 3

Rate limit SSH connections:

# Replace your SSH port number
sudo ufw limit 2222/tcp

This allows only 6 connections in 30 seconds, blocking brute-force attempts.

Advanced: Restrict SSH by IP

If you have a static IP address (like an office or home connection), restrict SSH to that IP only:

# Remove existing SSH rule
sudo ufw delete allow 2222/tcp

# Add IP-restricted rule (replace with your IP)
sudo ufw allow from YOUR_IP_ADDRESS to any port 2222

Note: Only do this if your IP rarely changes, or you will lock yourself out!

3. User Management

Proper user management limits the damage if an account is compromised.

Review Existing Users

# List all users
cat /etc/passwd | grep -E "/bin/bash|/bin/sh"

# Check sudo users
grep -Po '^sudo.+:\K.*$' /etc/group

Remove Unnecessary Users

Most VPS images create default users you might not need:

# Remove a user (example: ubuntu default user)
sudo deluser --remove-home ubuntu

Keep: Your admin user, root (cannot be deleted) Remove: Any default users you do not use

Strong Password Policies

Even though you use SSH keys, enforce strong passwords as a backup:

# Install password quality checking
sudo apt install -y libpam-pwquality

# Configure password requirements
sudo nano /etc/security/pwquality.conf

Add or modify these lines:

minlen = 16
minclass = 3
maxrepeat = 2
dcredit = 1
ucredit = 1
ocredit = 1
lcredit = 1

This requires:

  • Minimum 16 characters
  • At least 3 character types (upper, lower, number, symbol)
  • No more than 2 repeated characters

Lock Root Password

Since you use SSH keys and have disabled root login, lock the root password:

sudo passwd -l root

This prevents any password-based root login attempts.

4. Install and Configure fail2ban

fail2ban monitors log files and bans IPs that show malicious patterns (like multiple failed login attempts).

Installation

sudo apt install -y fail2ban

Basic Configuration

Create a local configuration file:

sudo nano /etc/fail2ban/jail.local

Add this configuration:

[DEFAULT]
# Ban IP for 1 hour after 3 failures within 10 minutes
bantime = 3600
findtime = 600
maxretry = 3

# Email notifications (optional)
destemail = your-email@example.com
sendername = Fail2Ban
mta = sendmail

# Actions
action = %(action_mw)s

[sshd]
enabled = true
port = ssh,2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

[nginx-http-auth]
enabled = false

[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
maxretry = 2

Important: Change port = ssh,2222 to match your actual SSH port.

Start and Enable fail2ban

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Monitor fail2ban

# Check status
sudo fail2ban-client status

# Check specific jail status
sudo fail2ban-client status sshd

# See banned IPs
sudo fail2ban-client status sshd | grep "Banned IP list"

# Unban an IP (if you locked yourself out)
sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

5. Secure Shared Memory

Shared memory (/dev/shm) can be used in attacks. Secure it by mounting with restrictions:

# Edit fstab
sudo nano /etc/fstab

Add this line:

tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

Apply the change:

sudo mount -o remount /run/shm

6. Disable IPv6 (If Not Needed)

If you are not using IPv6, disabling it reduces your attack surface:

# Edit sysctl configuration
sudo nano /etc/sysctl.conf

Add these lines:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Apply:

sudo sysctl -p

7. Kernel Hardening with sysctl

Improve kernel security settings:

# Edit sysctl configuration
sudo nano /etc/sysctl.conf

Add these security-focused settings:

# Prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirect requests
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0

# Ignore source-routed packets
net.ipv4.conf.all.accept_source_route = 0

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1

# Disable ICMP echo broadcasts (prevent smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Enable TCP SYN cookies (prevent SYN flood attacks)
net.ipv4.tcp_syncookies = 1

Apply:

sudo sysctl -p

8. Set Up Log Monitoring

Logs are your window into what is happening on your server. Set up basic monitoring:

Install Logwatch

Logwatch sends daily summaries of log activity:

sudo apt install -y logwatch

Configure:

sudo nano /etc/cron.daily/00logwatch

Add:

#!/bin/bash
/usr/sbin/logwatch --output mail --mailto your-email@example.com --detail high

Make it executable:

sudo chmod +x /etc/cron.daily/00logwatch

Manual Log Review

Know where to look when investigating:

# Authentication attempts
cat /var/log/auth.log

# System messages
cat /var/log/syslog

# Kernel messages
cat /var/log/kern.log

# Real-time log monitoring
sudo tail -f /var/log/auth.log

Useful commands for log analysis:

# Failed SSH login attempts
grep "Failed password" /var/log/auth.log

# Successful logins
grep "Accepted" /var/log/auth.log

# sudo usage
grep "sudo:" /var/log/auth.log

9. File Permissions

Ensure sensitive files have proper permissions:

# SSH configuration should be restricted
sudo chmod 700 /root/.ssh
sudo chmod 600 /root/.ssh/authorized_keys

# Your user SSH config
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/config

# Critical system files
sudo chmod 644 /etc/passwd
sudo chmod 640 /etc/shadow
sudo chmod 644 /etc/group

10. Docker Security Basics

Since you are running Docker, apply these security measures:

Run Containers as Non-Root

# In docker-compose.yml
services:
  picoclaw:
    image: sipeed/picoclaw
    user: "1000:1000"

Limit Container Capabilities

services:
  picoclaw:
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID

Use Read-Only Filesystems

services:
  picoclaw:
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    volumes:
      - ./config:/root/.picoclaw:rw

Keep Docker Updated

# Check Docker version
docker --version

# Update Docker
sudo apt update
sudo apt install --only-upgrade docker-ce docker-ce-cli containerd.io

Security Checklist

Use this checklist to verify your VPS security:

Access Control

  • Root login disabled via SSH
  • SSH key authentication enforced (no passwords)
  • SSH on non-default port
  • Unnecessary users removed
  • Strong password policy configured
  • Root password locked

Network Security

  • UFW firewall active and configured
  • Only necessary ports open
  • SSH rate-limited
  • IPv6 disabled (if not used)
  • fail2ban installed and running

System Security

  • Automatic updates enabled
  • Kernel hardening sysctl settings applied
  • Shared memory secured
  • Logwatch configured
  • Critical file permissions correct

Docker Security

  • Containers run as non-root when possible
  • Container capabilities limited
  • Docker kept updated

What is Next?

This chapter covered essential security practices. The next chapters cover:

  1. SSH Hardening (Premium) - Advanced SSH security with automation scripts
  2. Installing OpenClaw and PicoClaw - Deploying your AI assistants securely

Remember: Security is an ongoing process, not a one-time setup. Review your security posture monthly and stay informed about new vulnerabilities.

Next: SSH Server Hardening - Premium guide with advanced SSH security and automation scripts.