Add host security hardening guides - #940
Open
jacobmattern wants to merge 2 commits into
Open
Conversation
Replaces the single-topic SSH password page with a set of guides covering the configuration a host is expected to get right on every machine: SSH keys, accounts and sudo, the host firewall, management interfaces, system updates, drift checks, recovery, and a per-machine checklist. host/disable-ssh-password-login.mdx is folded into host/security/ssh-access in full, with a redirect and its two inbound links repointed. Nothing it told hosts was dropped, and the manual-edit path and early exit it offered are preserved. Every recommendation is paired with a command that shows current state, and every sample output was checked against Ubuntu Server 22.04 and 24.04 rather than written from memory. sshd, ufw, Docker, unattended-upgrades, and vendor BMC guidance were verified against upstream documentation. Two behaviours are called out because they are easy to get wrong and fail quietly: Docker publishes instance ports below ufw, so ufw governs host services only and its status is not evidence of what the internet can reach; and sshd -T does not evaluate Match blocks, so it can report clean on a machine that still accepts passwords. Automatic updates stay off, consistent with hosting-overview, with kernel updates checked periodically and applied in a maintenance window via upgrade-kernel.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Remove the per-machine checklist and drift-check pages. Defining a maintenance cadence for hosts is out of scope; defining the machine requirements Vast expects of them is not. Rename "Keeping the System Current" to "Disable Automatic Updates" and drop its maintenance-routine section, leaving the requirement and a pointer to Upgrade the Kernel. Fix commands that fail a direct copy-paste: - Read APT::Periodic with apt-config dump rather than cat-ing 20auto-upgrades, which misses 10periodic from update-notifier-common and can report a machine as clean while it still refreshes on a timer - Replace cp -n, which warns on coreutils 9.x and has no 22.04-safe alternative flag, with a portable [ ! -e ] guard - Promote the sshd port check ahead of the ufw limit rule - Run apt-get update before installing ipmitool, and note that every ipmitool command needs the machine to have a BMC Revise the prose across all seven pages to match the style of verification-stages and how-to-self-test. No command or sample output changed in this pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the single-topic SSH password page with a set of guides covering the configuration a host is expected to get right on every machine.
Closes docs-78w.9.
Structure
Host > Maintenance > Security Hardeningis a group whose title is itself the overview page (root), with eight guides beneath it:The folded page
host/disable-ssh-password-login.mdxis folded intohost/security/ssh-accessin full, with a redirect to it and its two inbound links fromverification-stages.mdxrepointed. Nothing it told hosts was dropped — the manual-edit alternative and the "if it already says no, you are done" early exit are both preserved.Approach
Every recommendation is paired with a command that shows current state. Every sample output was checked against Ubuntu Server 22.04 and 24.04 rather than written from memory, and
sshd,ufw, Docker,unattended-upgrades, and vendor BMC guidance were verified against upstream documentation.Two behaviours get explicit callouts because they are easy to get wrong and fail quietly:
ufw statusis not evidence of what the internet can reach — only a scan from outside is. This also means a missing ufw rule is not the cause when clients cannot connect, so the diagnosis table points at the router and upstream firewall instead.sshd -Tdoes not evaluateMatchblocks. A machine can report clean and still accept passwords, so the guide checks forMatchblocks directly.Automatic updates stay off, consistent with
hosting-overview.mdx, with kernel updates checked periodically and applied in a maintenance window viaupgrade-kernel.Safety
The pages that can leave a host unreachable — SSH Access and The Host Firewall — each open with a fallback-access prerequisite, including a branch for machines with no BMC. Steps that change state are ordered so the irreversible one comes after the check that proves it is safe, and every file the guides create or edit has a documented way back in Recovery.
Review
Reviewed by four passes covering command correctness, operational risk, completeness, and formatting. All internal links and anchors verified against a local Mintlify build; the
/host/disable-ssh-password-loginredirect resolves to the new SSH page.