First security hardening checklist

After deploying a VM, you are responsible for securing the operating system and applications you install. This checklist covers common first steps to improve security for new OneCloud instances.

Important

These are general best practices. Apply changes carefully and ensure you keep access to your server (especially SSH/RDP) before closing ports or changing authentication.

1) Update the operating system

Install the latest security updates immediately after first login.

Debian/Ubuntu

BASH

apt update && apt -y upgrade

RHEL/CentOS/AlmaLinux/Rocky

BASH

dnf -y update

2) Use SSH keys (Linux) and strong credentials

Prefer SSH key authentication over passwords for Linux.
Use strong, unique passwords for all accounts.
Store keys/passwords in a trusted password manager.

3) Create a non-root user (Linux)

Create a regular user and grant sudo access.

BASH

adduser deploy
usermod -aG sudo deploy

Caution

Test SSH login as the new user before disabling root login.

4) Restrict SSH access (Linux)

Common SSH hardening actions:

Disable password authentication (after confirming key access)
Disable root login
Change SSH port (optional; not a replacement for proper security)

SSH config file is typically:

/etc/ssh/sshd_config

Restart SSH after changes:

BASH

systemctl restart ssh

5) Configure a firewall

Allow only required ports (for example, SSH and HTTP/HTTPS).

Example (UFW on Ubuntu):

BASH

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

6) Enable automatic security updates (optional)

On some distributions you can enable unattended upgrades to reduce patching gaps.

Tip

Automatic updates are helpful, but test carefully if you run sensitive workloads.

7) Install intrusion prevention (optional)

Common tools include:

Fail2ban (Linux)
OS-level brute-force protections (Windows security policies)

8) Backups

Ensure you have a backup plan before going into production:

Application-level backups
Database dumps
Snapshot/backup features (if available in your plan)
Offsite copies for disaster recovery

9) Review exposed services

Remove unused packages/services
Confirm only required ports are open
Avoid running admin panels publicly without protection (VPN, IP allowlist, MFA, etc.)

Note

If you need help deciding what ports should be open for your use case, prepare a list of your applications/services and contact Support for general guidance.