How to harden a Quake AI virtual machine

Harden a freshly provisioned Linux virtual machine before it serves traffic. Restrict network access with security groups, reduce SSH exposure in the guest OS, add a host firewall, enable automatic security updates, and block repeated login attempts.

Start from a virtual machine you can SSH into. If you still need to create one, follow the production virtual machine provisioning guide first.

Step 1. Restrict the security group#

Security groups filter traffic before it reaches the instance. Remove broad rules, then add the ports your workload needs.

Target posture for a typical web VM:

Replace ADMIN_CIDR with your office or home /32 (for example, 203.0.113.45/32). Use 0.0.0.0/0 for SSH only when you cannot name a narrower range.

Step 2. Create a non-root sudo user#

Run day-to-day work as an unprivileged account. Keep the bootstrap user (often ubuntu or cloud-user) until the new account works.

Connect from your workstation with the bootstrap user. Keep this session open through the remaining steps:

ssh BOOTSTRAP_USER@VM_FLOATING_IP

The SSH prompt confirms that the guest OS is ready for the following commands.

sudo adduser deploy
sudo usermod -aG sudo deploy
sudo mkdir -p /home/deploy/.ssh
sudo cp ~/.ssh/authorized_keys /home/deploy/.ssh/
sudo chown -R deploy:deploy /home/deploy/.ssh
sudo chmod 700 /home/deploy/.ssh
sudo chmod 600 /home/deploy/.ssh/authorized_keys

For a repeatable baseline, see the Configure a VM with Ansible template.

Step 3. Harden secure shell access#

Edit sshd_config, validate the syntax, and reload the daemon. Keep an existing session open while you test changes.

sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
echo 'MaxAuthTries 3' | sudo tee -a /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl reload ssh

Optional: change the SSH port only if your security group and host firewall rules already allow the new port. Update the security group before you change Port in sshd_config.

Step 4. Enable a host firewall#

A host firewall adds a second traffic filter behind the security group. A connection succeeds when both layers allow it.

sudo apt update
sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
# Omit the next two rules when the VM does not serve web traffic.
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

Step 5. Enable automatic security updates#

Configure the guest OS to install security patches automatically. This covers unattended security fixes; plan reboot windows when kernels update.

sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Step 6. Install fail2ban for SSH#

fail2ban watches authentication failures and temporarily blocks offending source IPs in the host firewall.

sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
maxretry = 5
findtime = 10m
bantime = 1h
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Step 7. Verify the hardening#

Run these checks from your workstation and on the VM.

Key-only SSH works for the sudo user:

ssh deploy@VM_FLOATING_IP

The SSH daemon refuses password login (expect Permission denied):

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no deploy@VM_FLOATING_IP

Intended ports respond from the internet. From outside the VM, scan the floating IP:

nc -zv VM_FLOATING_IP 22
nc -zv VM_FLOATING_IP 80
nc -zv VM_FLOATING_IP 443
nc -zv VM_FLOATING_IP 3306

Port 3306 (or another port you did not open) should fail to connect.

On the VM, confirm services:

sudo ss -tlnp
sudo systemctl is-active fail2ban

Related documentation#

• Production virtual machine provisioning guide: launch workflow this page continues
• How to patch and update a Quake AI virtual machine: ongoing OS updates after hardening
• Security hardening checklist: project-wide audit list
• Security groups concept: how the Network service filters instance traffic
• How to create security group rules: rule fields and Console presets
• Configure a VM with Ansible: idempotent hardening playbook