Halloween

Up to 35% off servers Up to 35% off Starts in --d --:--:--

Menu
Free trial

Try it free for 24 hours

We keep two servers open, one in Germany and one in Miami. Join from Java or Bedrock, on whatever version you run, and see how they perform before paying for anything.

If after the trial you decide it's not for you, you pay nothing. If you keep it, billing starts the next day at the regular price.

Request my trial

Basic security for your VPS with an application

Which ports come open, how to protect root and your application accounts, care with Docker ports and AI agents, and updates.

38 views Updated 17 Oct 2026

Your VPS is delivered with a secure starting configuration, but it is your server: from there on, keeping it that way is up to you. These are the basics.

The firewall

The system firewall (ufw) comes enabled with only three openings: SSH, 80 and 443. The application is only reachable over HTTPS; its internal ports are not exposed. You can check it with:

ufw status
  • Do not close 80 or 443: the HTTPS certificate and your application use them.
  • If you install something else that needs a port, open only that port (ufw allow 8443/tcp, for example); never turn the firewall off.

Important: on n8n and Dokploy, ports you publish from Docker bypass ufw and are reachable from the Internet even if they do not show in ufw status. Publish only what is essential.

The root account

  • Change the root password if you have shared it or stored it somewhere unsafe. You can reset it from your server page in the client area, or over SSH with passwd.
  • For more security, log in with an SSH key instead of a password.
  • Do not share root access with anyone who does not need it.

Your application accounts

  • Change the application's initial password to one of your own and keep it in a password manager.
  • Turn on two-factor authentication where available: n8n and Dokploy have it in the user profile.
  • In OpenClaw, the token grants full access: do not share it, and each new browser is approved from the server.
  • In Hermes Agent, the panel includes a terminal; for more protection, restrict access by IP or use Nous Research account login.

AI agents

OpenClaw and Hermes Agent run commands on your server. That is why they are installed under their own user without administrator rights:

  • Do not give them root access or add them to the sudo group.
  • Treat anything that arrives through the channels as untrusted: someone could try to give the agent instructions. Keep code pairing enabled.
  • In Hermes, keep dangerous-command approval enabled.

Updates

You decide when. Update the system regularly (apt update && apt upgrade -y) and your application following its guide. On Dokploy, the Docker packages are held on purpose: do not force them.

Never share credentials

We will never ask for your passwords, tokens or keys. Do not paste them in tickets, chats or public channels, and do not publish the contents of /root/astrol-app.txt or of the .env files. If you have, change them as soon as possible.

VPS with an app: n8n · OpenClaw · Hermes Agent · Dokploy

Was this article helpful?

Related articles

Getting started with your n8n VPS Getting started with your OpenClaw VPS Getting started with your Hermes Agent VPS Getting started with your Dokploy VPS Where to find your application login details

Need more help?

Open a ticket and the support team goes through it with you.

Open a ticket