Blog › Security
Security · 12 min read

Zero-Trust Security for Cloud Instances: A Practical Checklist

RH
Rami Hassan ·March 6, 2025 ·12 min read

Every instance on VeloxaHost starts hardened at the infrastructure level — unprivileged containers, restricted project modes, and deny-all network defaults. But defense in depth means adding your own security layers too. Here's a complete checklist.

⚠️

Security hardening should be done before your application goes live. Retrofitting security on a running production system is much harder.

1. SSH Key-Only Authentication

Disable password authentication immediately after deploying:

# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
MaxAuthTries 3

Then restart SSH: sudo systemctl restart sshd. From this point, only users with a valid private key can log in.

2. Firewall Rules via VeloxaHost Console

Use the VeloxaHost Firewall page to create a policy with the principle of least privilege:

  • Allow SSH (22) from your office/VPN IP only — never 0.0.0.0/0
  • Allow 80/443 from anywhere for web-facing services
  • Drop everything else — inbound and outbound default deny

3. fail2ban — Brute Force Protection

sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit /etc/fail2ban/jail.local and set:

[sshd]
enabled  = true
maxretry = 5
bantime  = 1h
findtime = 10m
sudo systemctl enable --now fail2ban

4. Automatic Security Updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

This automatically installs security patches daily. Critical CVEs get patched without you needing to remember to run apt upgrade.

5. Audit Logging

Every SSH login, sudo command, and file write on a production instance should be logged:

sudo apt install auditd -y
sudo systemctl enable --now auditd

Forward logs to your centralized logging system (Loki, CloudWatch, Datadog) so they're preserved even if the instance is compromised.

Checklist Summary

  • ✅ SSH key-only — no passwords, no root login
  • ✅ Firewall — allowlist, not blocklist
  • ✅ fail2ban — auto-ban brute-force IPs
  • ✅ unattended-upgrades — auto security patches
  • ✅ auditd — every privileged action logged
  • ✅ VeloxaHost monitoring — CPU/mem/disk alerts for anomaly detection