Locked down an OVH VPS hosting a privacy-focused self-hosted stack
A self-hosted analytics + recipes stack about to be pointed at customer-facing subdomains.
- Customer
- Privacy-focused product team
- Team size
- 5 people
- Provider
- OVH
- OS
- Debian 12
- Plan · Duration
- Standard · 16 hours
A five-person product team self-hosting Plausible Analytics, a recipe manager, and a few internal tools on a single OVH VPS. They wanted the box locked down before they pointed customer-facing subdomains at it — and before they trusted it with anything sensitive.
They'd set the box up themselves and "thought it was fine." Their lead engineer had a strong instinct that something was off but couldn't find time to dig in. They wanted a fresh, methodical pass with a written report they could file with their compliance docs.
What we found on the box.
First pass before changing anything. Severity ranges from critical (act immediately) to low (worth knowing).
-
critical
Default OVH root password unchanged
-
critical
Docker daemon listening on
tcp://0.0.0.0:2375with no TLS or auth -
high
OVH firewall in monitoring-only mode (rules existed but were not enforced)
-
high
No SSH keys configured — password auth only
-
medium
No swap; 1GB RAM box hit OOM ~4 times per week under normal load
-
medium
22 days of unapplied security patches
What we changed, in order.
Each change is reversible and documented in the handover doc. Commands shown are illustrative.
-
1
Disabled the Docker TCP socket entirely; switched all clients to the local Unix socket.
-
2
Created an
opsuser, installed the three team members' SSH keys. -
3
SSH: keys-only, root locked, custom port,
MaxAuthTries 3. -
4
Provisioned a 2GB swap file with
swappiness=10. -
5
UFW with
iptables=falsehandling for Docker, plus explicit allow rules for 22 (custom), 80, 443. -
6
Promoted the OVH network firewall from monitor mode to enforcing.
-
7
unattended-upgradesconfigured for security patches. -
8
Replaced
watchtowerauto-pull (responsible for two prior outages) with a manual update procedure documented in their runbook.
The numbers that moved.
Representative figures from this engagement. Real, named-customer studies will publish actual numbers with a link to verify.
Other sample engagements
See all
Hand us your VPS, get an engagement like this one.
Pick a plan, send the credentials through the encrypted form, and we'll come back with the same kind of audit + hardening + handover the studies above describe.