VPS security, Nginx configuration, UFW, users, and SSH login

Prerequisites

To get started, let’s install nginx, docker, and ufw.

sudo apt update && sudo apt install nginx docker.io ufw -y

Initial User Setup

It is not safe to work as the root user, so you need to create a new user with the command adduser your_name and grant them administrator privileges using usermod -aG sudo your_name and groups your_name.

After that, a notification about adding the user Adding user "your_name" ... will appear in the console, along with a field for entering a password.

Configuring SSH Key Authentication

This is a reliable way to protect against brute-force attacks. If you already have an ssh key, simply send it to the server using ssh-copy-id your_name@server_ip; if not, generate one with ssh-keygen -t ed25519 -C "your_name@vps"

When copying this way, you may be prompted to enter the server password; for security reasons, the password will not be displayed as you type!

Disabling Password Login and Root Access

Now you need to block all login methods other than the ssh key. Open the config file sudo nano /etc/ssh/sshd_config, then find and modify (or add) the following lines:

• PermitRootLogin no - prevents direct login as the root user via ssh;
• PasswordAuthentication no - disables the ability to log in to the server using a standard password;
• ChallengeResponseAuthentication no - disables challenge-response authentication.

Restart the service sudo systemctl restart ssh; now, when attempting to log in as root, you will receive the error root@ip: Permission denied (publickey).

Configuring the firewall

The firewall blocks all ports except those that are allowed.

For added security, you should change the ssh port to a different one and also add it to the ufw config!

Configuring UFW

sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

The status command will show whether ufw is enabled and which ports are allowed.

React2Shell Vulnerability in NextJS

React2Shell is a critical vulnerability that allows hackers to execute their code on the server.

To check, look through the list of processes and files; if any of the following are found, the server is compromised:

• Files named ssh.sh, sex.sh, kai.tar.gz, or httd;
• The xmrig process (a miner that uses 100% CPU):
  • You can check this using the top or htop command.

To protect against the virus, update NextJS to one of the secure versions (see the NextJS website), update NodeJS, and run Docker containers via --read-only under USER node with access via Whitelist

If the project has been compromised, you need to delete the infected pods/containers, clear the cache, and be sure to change all keys and passwords.