Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

SSH Access

1.3. SSH Access — The Admin Gateway Must Be Tight

Principles, not specific configuration steps

SSH is the front door into the server itself — independent of whether you choose Docker or a direct install in chapter 2. Three principles to settle at the infrastructure layer, before touching the Hermes installation:

  • Only accept key-based login; no passwords.
  • Consider changing the default SSH port if the server is still exposed to the public internet.
  • Always confirm an alternative access route (e.g., through Tailscale in 1.5) works before locking down the public route — do not lock yourself out of the VPS.

Notes

  • On VPSes with a browser-based management console, avoid pasting commands with special characters through it — many providers mangle characters, silently corrupting long install commands (especially the docker run with many environment variables in 2.3). Always work over real SSH.
  • End goal: the public SSH port fully closed, access only via the Tailscale IP — reaching this goal before starting the install in chapter 2 keeps the entire process on a channel that is already safe.