Production Linux VPS Hardening: Docker Orchestration, Nginx Reverse Proxy & SSL Security

Launching a new cloud server on DigitalOcean, AWS, or Hetzner is simple, but leaving the default configuration intact exposes your production applications to automated botnets, brute-force SSH attacks, and resource exhaustion. At SOFT-ITBD, every server we provision passes through our standardized 7-step production hardening protocol.

1. Disable Root Login & Password Authentication

Never allow direct SSH login as root or password-based authentication. Generate a 4096-bit ED25519 SSH key pair, create a non-root sudoer user, and modify /etc/ssh/sshd_config:

# /etc/ssh/sshd_config hardening
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3

2. Configure UFW Firewall & Fail2ban Intrusion Prevention

Close all unnecessary inbound ports. For a web server hosting Docker containers behind Nginx, only SSH, HTTP, and HTTPS ports should be reachable:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Then install fail2ban to automatically block IP addresses that fail authentication 3 times within 10 minutes.

3. Isolating Web Services with Docker Compose

Instead of installing PHP, Node.js, and databases directly on the host operating system, containerize every component. Bind container ports only to the loopback interface (127.0.0.1:8000:80) rather than 0.0.0.0, forcing all traffic to pass through your hardened Nginx reverse proxy.

4. High-Performance Nginx Reverse Proxy with Automated SSL

Configure Nginx with HTTP/2 support, modern TLS 1.3 ciphers, and automated Let's Encrypt SSL certificate renewals via Certbot.

Conclusion

Hardening your Linux server requires less than 30 minutes of setup, but prevents devastating ransomware attacks, unauthorized database exfiltration, and server downtime. Need professional server administration or automated DevOps pipelines? Explore our Server Management Services or contact us at SOFT-ITBD.