Change the SSH Port#

Edit the SSH config file /etc/ssh/sshd_config and change the default port 22:

1
vim /etc/ssh/sshd_config
2
# Find #Port 22, change to Port your-port
3
# Save and restart the service
4
systemctl restart ssh

Create a Non-root User#

1
# Create a new user
2
adduser your-username
3

4
# Install sudo
5
apt install sudo
6

7
# Add the user to the sudo group
8
usermod -aG sudo your-username
9

10
# Or edit /etc/sudoers to add:
11
# your-username ALL=(ALL) NOPASSWD: ALL

Disable Root Remote Login#

1
# In /etc/ssh/sshd_config, set:
2
PermitRootLogin no

SSH Key Authentication + Disable Passwords#

1
# Generate a key pair locally, then copy the public key to the server
2
ssh-copy-id your-username@your-server-ip
3

4
# In /etc/ssh/sshd_config:
5
PasswordAuthentication no
6
PubkeyAuthentication yes
7

8
# Restart the service
9
sudo systemctl restart ssh

Docker#

Refer to the official Docker documentation for installation.

Nginx Proxy Manager#

Install NPM via Docker for a web UI to manage reverse proxies and SSL certificates.

SSL Certificates#

Use acme.sh + Cloudflare DNS API to issue wildcard certificates with auto-renewal.

Internal Network Tunneling (frp)#

Use frp for internal network tunneling. Newer versions use TOML configuration.

Alist#

Multi-storage mounting tool with one-click Docker deployment. See Alist documentation for details.

Firewall#

• Remember to allow the new SSH port in the firewall
• Use iptables to mitigate SYN and CC attacks
• Only expose necessary ports (80, 443, SSH, etc.)