Basic VPS security configuration

Applications from the Marketplace catalog are installed on the VPS in a basic configuration. If an application has no tools of its own for obtaining SSL certificates and ships with an unprotected http connection (for example, Portabase), a reverse proxy with a self-signed certificate is configured during the installation. Applications with their own certificate issuing tool (Portainer) or with a built-in web server and reverse proxy (Dokploy) use their standard mechanisms. Further security configuration is performed by the client.

Why security is not configured by default

The set of required restrictions is determined by the server usage scenario: the public services, the administrators, and the type of data processed. The basic configuration keeps the application fully operational in any scenario. It is recommended that the client configure the protection for their specific task themselves.

Recommendations

A minimum set of measures after installing an application:

• Restrict access to administrative panels and SSH. Allow connections only from trusted IP addresses, for example using the built-in operating system firewall.
• Restrict access to sensitive information. Block direct access from the internet to sections with personal data, payment information, and credentials.
• Change the passwords issued during installation. Use unique strong passwords for each service. The password change procedure depends on the application, see the application documentation.
• Enable two-factor authentication if the application supports it. The procedure is described in the application documentation.
• Use SSH keys instead of passwords to connect to the VPS.
• Update the operating system and the installed application regularly.
• Set up HTTPS if the application does not use it. Sign: the address in the Admin URL field starts with http://. Setting up your own domain and SSL certificate is described in the "Connecting a custom domain and SSL" document.

The listed measures are not exhaustive: typical VPS security hardening practices also apply to servers with applications from the Marketplace.