From Digital Entropy to an Impenetrable Fortress: Anatomy of an Extreme VPS Hardening - Part I

We've all been there. You spin up a $5 VPS, get root access, and the excitement kicks in. Docker here, FTP there, a GUI because "the terminal gets old", twenty containers running things you barely remember deploying. It feels productive. It isn't. What it actually is, is a ticking clock. This post documents the full process of turning that kind of server — exposed, noisy, chaotic — into infrastructure that defends itself while you sleep.

1. The Diagnosis: What a "Typical" VPS Actually Looks Like

Before touching anything, you need to understand what you're dealing with. And the best way to do that is to stop assuming the server is fine and start looking at the evidence. The forensic analysis of a typical, unmanaged VPS tells a very uncomfortable story.

A. The "Swiss Cheese" Attack Surface

Running ss -tulpen is the first step toward confronting reality. Most people are surprised by what they find. The exposure is usually total:

FTP and RDP open to 0.0.0.0 means open to the entire internet. Services like avahi-daemon and cups running on a cloud server make zero sense — your VPS doesn't need to discover printers or mDNS devices. And those Docker containers mapped to public ports? Each one is a personal invitation to every vulnerability scanner on the internet.

B. The GUI Mistake

Installing a graphical interface on a server is one of those decisions that seems harmless until it isn't. It doesn't just waste RAM. It pulls in hundreds of vulnerable dependencies — X11, audio stacks, display managers — that have no business being on a headless server. An attacker can exploit the window manager to escalate privileges in an environment that should never have had one in the first place.

C. The Container Graveyard

docker ps -a on a neglected server usually looks like a cemetery. Containers with status Exited (1) from months ago. Bare ubuntu and alpine images with no orchestration. This is Shadow IT: services the admin forgot exist, still consuming disk space and potentially exposing stale data. That /var directory sitting at 22GB? That's mostly this.

2. The Fix: Segregation, Visibility and Defense

Hardening isn't about installing a magic tool. It's about making deliberate decisions and not crossing the lines you draw. Three pillars. No exceptions.

A. User Hierarchy and Least Privilege

Most people run everything as root. It's comfortable right up until it isn't. The moment something gets compromised, the attacker has the keys to everything. The fix is simple: decide what each identity is allowed to do, and never let it do more than that.

If a container gets compromised and the attacker lands in services, they're stuck. No shell, no lateral movement, no path to escalation. That friction is the point.

B. Filesystem Standardization (/opt)

A professional server doesn't have scripts scattered across /home and /root. Everything lives under /opt, organized and with strict permissions. This isn't cosmetic — it's containment. Moving offensive tools like recon and exploit out of the standard PATH means an automated exploit landing on your server won't find them. It would have to know exactly where to look.

/opt/
 ├── services/   # Production apps (Docker Compose)
 ├── lab/        # Test environments and ethical hacking
 ├── tools/      # Maintenance scripts and binaries
 └── data/       # Persistent volumes and centralized logs

If the server goes down tomorrow, this structure tells you exactly what to save and where it is. That's not just security — that's operational sanity.

3. Network Hardening: Firewall Policy and the Tailscale Layer

Here's the thing about firewalls that most tutorials get wrong: the goal isn't to close every port you can find. The goal is to have a default policy of deny everything, and then consciously open only what you can justify. Everything else stays closed, forever, by default.

Three ports. That's it. Every Chinese and Russian bot scanner hits a wall. Every automated exploit trying random ports gets nothing. Three vectors to monitor instead of thirty.

And here's the part I find most elegant: Tailscale. With tailscaled.service running, Portainer, databases, internal services — none of them need a public port. They're only accessible through the private VPN mesh. To any scanner on the internet, they simply don't exist. Shodan can't index what it can't reach.

4. Automation: The Difference Between Sysadmin and Professional

The gap between someone who manages a server and someone who engineers infrastructure comes down to one thing: automation. You shouldn't be logging in to check if everything is fine. The server should be telling you.

A. SSH Audit Reports (Cron + Scripts)

Reading through /var/log/auth.log manually is not security operations — it's self-inflicted pain. The solution is a script that runs every night at 23:00 and drops a clean summary into a log file. No intervention required. If something happened during the day, you'll know about it in the morning.

Over time, /var/log/ssh-summary.log becomes an intelligence feed. You start noticing patterns: recurring IP ranges, consistent scanning hours, country clusters. That's situational awareness you couldn't get from staring at raw logs.

While you're in the crontab, also schedule rkhunter for weekly rootkit scans and unattended security patches. If a critical CVE drops on a Tuesday night, you don't want to find out about it two weeks later.

5. Storage Audit: Docker and Snap Will Eat Your Disk

Nobody warns you about this when you start stacking containers and Snap packages on a server. It doesn't happen all at once. It's gradual. And then one day you run df -h and the disk is at 87% and you genuinely don't know where it went.

Those 22GB in /var are mostly Docker orphans: images from containers you deleted months ago, build cache layers, volumes from services you stopped running. A single docker system prune -a --volumes can reclaim a significant chunk of that.

Snap is a different problem. By default it keeps the last two versions of every package installed. With a handful of security tools installed via Snap, that adds up fast. One line fixes it permanently.