You administer your own ArkHost Linux VPS, including SSH access. Changes to SSH and firewall settings can lock you out of the server. The VPS console in your Client Area is the recovery path if network access fails.
Pre-flight checks
Complete all of these before changing anything:
- Confirm you can open the VPS console from the Client Area and log in there.
- Keep a second terminal session logged in to the VPS while you work. Do not close it until every change has been tested.
- Set up SSH key login and test it from a new, separate session.
- Write down the ports your applications need, so firewall changes do not break them.
A safe order of changes
Work in this order, and test a brand new connection after every change:
- Add your SSH public keys and confirm key login works from a new session.
- If you edit the SSH server configuration, validate it before reloading the service, for example with
sshd -t. A syntax error can stop SSH from starting. - Only after key login is proven, disable password authentication.
- Apply firewall changes one rule at a time. Confirm the SSH port stays reachable from your current address before adding further restrictions.
Restricting SSH to a VPN or private network
If you plan to limit SSH to a WireGuard or private network, that connection must already be installed and tested as a working, separate route. Verify you can log in over it from a new session before narrowing any SSH or firewall rule.
What not to do
- Do not run an arbitrary
ufw reset. It removes all existing rules, including the one keeping your current session reachable. - Do not copy a fixed private network range from any guide. Use the actual addresses of your own VPN or network.
- Do not close your only working SSH session before a replacement route is tested.
- Do not block the provider console. It is your recovery path.
Hardening reduces exposure, but no set of changes eliminates attacks. Review access periodically and keep the recovery route working.
