SSH policy, UFW, Fail2Ban, and updates.
ServerChirp manages common host-security controls while leaving the server under your ownership. Security changes are reconciled through the outbound agent and recorded as operations.
Choose one update policy per server:
Application compatibility remains your responsibility. Review runtime and database release notes before applying a major version change.
You can disable or re-enable root SSH login. Before disabling it, create a system user with a working public key and the required sudo policy. Keep an active session open until the new login has been verified.
Firewall rules can allow or deny TCP or UDP traffic for a port, range, IP address, or CIDR. Platform-managed SSH, HTTP, and HTTPS rules cannot be edited or deleted. ServerChirp rejects an unrestricted TCP deny that covers the server's SSH port because it would immediately lock out every operator.
Allow TCP 443 from anywhere
Allow TCP 22 from 203.0.113.0/24
Deny TCP 5432 from anywhereBlocking an address from an application's Nginx logs also creates a UFW deny rule. It has no port restriction, so it blocks that source from the entire server—not just the application whose log you were viewing. The log explorer can use the exact address or widen it to an IPv4 /24 or IPv6 /64 network.
ServerChirp's Fail2Ban integration manages only the SSH (sshd) jail. Configure enablement, attempts before a ban, detection window, ban duration, and trusted addresses. The dashboard shows the live jail's failure and ban totals and lets an authorized operator remove an address from it.
Fail2Ban and log-based firewall blocks are separate controls. Blocking an application-log address does not add it to Fail2Ban, and removing an address from the Fail2Ban jail does not delete a UFW rule.
Applications can run under shared or isolated system users. Provider credentials and structured application secrets are encrypted at rest and omitted from public resource shapes. File-based application environments remain plaintext files on the server and are readable to authorized team members through the dashboard.
For production teams, combine isolated users, narrow team permissions, short-lived SSH access, and external backups stored outside the server.