Securing a HestiaCP server

• The rules you set on Hestia's Firewall page (or with v-add-firewall-rule) are applied by `v-update-firewall`. It flushes the INPUT chain, rebuilds it from Hestia's rules and sets INPUT's policy to DROP.
• Hestia's fail2ban jails ban through Hestia's own commands, in fail2ban-<name> chains that Hestia hooks into INPUT for each service.
• Hestia also manages ipset lists, for blacklists and whitelists. Its firewall documentation warns that it clears iptables rules that were not added through Hestia or its custom.sh script.

So a rule added by hand with iptables does not survive the next firewall change in Hestia. Any tool that adds its own rules has to put them back.

• Its rules live in its own chains (INFRAFENCE and the others), which Hestia's rebuild of INPUT does not touch. Only the jump from INPUT is lost when Hestia flushes the chain.
• It puts that jump back within a minute, ahead of any rule that can accept traffic, so its bans also apply to the ports Hestia opened. It never adds an accept rule, so it never opens anything Hestia closed.
• fail2ban is left alone. Hestia's fail2ban-<name> chains and jails are not touched: both only drop traffic, so they don't conflict.
• If Hestia rebuilds the firewall again and again, the agent reports a firewall conflict event, so you know where to look (Coexistence).

• It recognises HestiaCP from /usr/local/hestia and reads its version from hestia.conf, and the dashboard shows both.
• It never edits the web server configuration. Hestia manages nginx and Apache, so the agent adds no ModSecurity rules and no user-agent blocks; bots set to Block are banned at the firewall instead (Bots).
• It reads every site's access log, from the web server configuration Hestia writes, and skips the .bytes files Hestia uses for bandwidth counters (Web firewall).
• It scans every site for malware: /home/<user>/web/<domain>/public_html is found on its own, with its domain (Malware).
• It can verify your sites for the trust badge by writing its verification file in the site's web root (Trust badge).
• It stops SSH brute force at the firewall, can close database ports open to the internet when you ask from the dashboard, and watches outbound traffic, DNS and file integrity, like on any Linux server.

1. Run the read-only check first: the installer's --dry-run reports what would get in the way and changes nothing.
2. In the dashboard, Servers › Add server creates an install token, valid for one hour.
3. Run the install command as root over SSH. Nothing in Hestia needs to change.

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --dry-run

HestiaCP runs on Debian and Ubuntu, both among the 15 distributions the agent is tested on before every release (Supported distributions).