Hardened a Contabo Cloud VPS running a Discord bot at scale
A bot reaching 40k Discord servers, running as root, with the token in a world-readable config.
- Customer
- Discord bot operator
- Team size
- Solo, ~40k Discord servers
- Provider
- Contabo
- OS
- Ubuntu 24.04
- Plan · Duration
- Standard · 14 hours
A solo operator running a Discord bot used in roughly 40,000 Discord servers. The bot kept the box busy and the operator hadn't had time to learn server admin properly. We tightened everything around the bot without changing the bot itself.
A friend in their dev community had had their bot token leaked from a similar setup the previous month. They didn't want to be next.
What we found on the box.
First pass before changing anything. Severity ranges from critical (act immediately) to low (worth knowing).
-
critical
Bot process running as
root -
critical
Bot token stored in a world-readable config file
-
high
SSH on port 22 with password authentication
-
high
No firewall configured
-
medium
Bot logs filling root partition (8% disk free, no rotation)
-
low
Outbound being silently rate-limited by Contabo (visible as Discord 429s)
What we changed, in order.
Each change is reversible and documented in the handover doc. Commands shown are illustrative.
-
1
Created a dedicated
botuser; bot service rewritten as a systemd unit running as that user. -
2
Moved bot token into a systemd
EnvironmentFilewith mode600, owned by the bot user. -
3
SSH: keys-only, custom port, root locked.
-
4
UFW: deny inbound except the custom SSH port (the bot needs no inbound traffic).
-
5
fail2ban with an aggressive SSH jail (
maxretry=2,bantime=24h). -
6
unattended-upgradesfor security patches. -
7
logrotateon bot logs: 7 daily, 4 weekly, compressed. -
8
Discord webhook for service-down alerts via
OnFailure=systemd hook.
The numbers that moved.
Representative figures from this engagement. Real, named-customer studies will publish actual numbers with a link to verify.
Other sample engagements
See all
Hand us your VPS, get an engagement like this one.
Pick a plan, send the credentials through the encrypted form, and we'll come back with the same kind of audit + hardening + handover the studies above describe.