Harden a VM

The platform enforces one rule on your machine — anti-spoof, which lets it send only from its own IP and MAC — and filters nothing else. There is no firewall API; you set the policy in the guest. **A rule that drops your own SSH locks you out until you boot rescue**: there is no console and no password.

Never apply a rule you cannot undo

Apply firewall and sshd changes with an automatic undo: schedule the revert *first*, confirm you still have access, then cancel the revert.

# 1. schedule the undo before you change anything
systemd-run --on-active=10min --unit=fw-revert nft flush ruleset

# 2. apply your ruleset
nft -f /etc/nftables.conf

# 3. from somewhere else, open a SECOND ssh session and confirm it works

# 4. only then, cancel the undo
systemctl stop fw-revert.timer

If step 3 fails, do nothing: the timer fires and the machine lets you back in. For ufw, step 1 is `systemd-run --on-active=10min --unit=fw-revert ufw disable`; the rest is the same. For sshd, the undo puts back a copy of the config:

cp -a /etc/ssh /root/ssh.bak
systemd-run --on-active=10min --unit=ssh-revert \
  sh -c 'rm -rf /etc/ssh && cp -a /root/ssh.bak /etc/ssh && systemctl restart ssh'
# change the config, restart ssh, then confirm a NEW session connects
systemctl stop ssh-revert.timer

Test with a new session while the old one is still open: the session you are holding survives a restart that broke the config.

Take a snapshot before any larger change; it is the only other way to undo one. It bills for as long as you keep it, and rolling back needs the VM stopped and leaves it stopped.

A policy that fits this platform

• Inbound: default deny, allow what you serve. We filter nothing in front of your VM, so every port you leave open is open to the Internet.
• Keep 22 reachable from wherever you connect. If that is a fixed address, allow only that address; if it is not, leave 22 open to the world and rely on keys — an unreachable machine is a worse outcome than an exposed SSH port that takes no passwords.
• Outbound: allow. Filtering your own egress breaks package updates in ways that are tedious to find.
• Do not filter loopback, and allow established/related before anything else. Without it, replies to the machine's own outbound connections are dropped.

sshd

Key-only login is already the default, so the useful changes are small:

• PermitRootLogin no. Log in as ubuntu and use sudo.
• PasswordAuthentication no and KbdInteractiveAuthentication no, so a future image change cannot turn one back on without you noticing.
• Leave the port at 22 unless you have a reason. Moving it reduces log noise but does not hide the machine from scanners.

Run sshd -t before restarting: sshd will not start with a config it cannot parse, and then you cannot log in.

Already locked out: [Debug a VM that will not come up](debug-vm-boot.md#5-if-the-guest-locked-you-out).