---
title: "Comment by StackShortlist on \"Secure a Linux VPS in 15 Minutes\" | Hashnode"
description: "Keeping the root session open until a second login as deploy works is the step that saves people from a lockout. One thing worth checking on cloud images: a dro"
url: "https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578/comment/6ad31f2a506d9e109c1831e9"
---

[Discussion](https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578)

Comment [Secure a Linux VPS in 15 Minutes](https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578)

[StackShortlist](https://hashnode.com/@veristria)

[Oct 17](https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578/comment/6ad31f2a506d9e109c1831e9)

Keeping the root session open until a second login as deploy works is the step that saves people from a lockout. One thing worth checking on cloud images: a drop-in under /etc/ssh/sshd\_config.d/ such as 50-cloud-init.conf can already set PasswordAuthentication yes, and sshd keeps the first value it reads, so running sshd -T | grep passwordauthentication after the reload shows what actually applies. Also, ports published by Docker containers can skip the ufw rules entirely.

[Pro Gineous](https://hashnode.com/@progineous)

[Oct 17](https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578/comment/6ad31f2a506d9e109c1831e9#reply-6ad3b8a9132583df6a099de5)

Thanks, StackShortlist, both points are worth adding. On Ubuntu 22.04+, the Include for /etc/ssh/sshd\_config.d/\*.conf sits at the top of sshd\_config, so drop-ins are read first, and for most options sshd keeps the first value it sees. A cloud-init 50-cloud-init.conf with PasswordAuthentication yes therefore beats the main file. Fix that file or add an earlier-sorting drop-in like 00-hardening.conf, then confirm with `sudo sshd -T | grep -i passwordauthentication`. On Docker: published ports go through iptables DNAT and the FORWARD chain, so ufw's INPUT rules never see them. Bind to 127.0.0.1:port:port, filter in the DOCKER-USER chain, or use ufw-docker.

[StackShortlist](https://hashnode.com/@veristria)

[Oct 18](https://hashnode.com/posts/secure-a-linux-vps-in-15-minutes/6ad30dc72551575ebc9bf578/comment/6ad31f2a506d9e109c1831e9#reply-6ad4776cca0015c00852d0de)

The 00-hardening.conf drop-in is a clean fix, since it survives cloud-init rewriting its own file. And DOCKER-USER is the part most guides miss, so readers will be glad to see it in the post.