Production VPS Hardening Checklist for Automated Trading Bots

Automated trading bots handle live exchange API keys and funds, making their hosting environment a high-value target. Follow this checklist to secure a fresh Linux VPS (Ubuntu/Debian) before deploying your trading scripts.

1. Create a Non-Root User and SSH Keys

Never run system administration tasks or trading scripts as root. Create a dedicated user with sudo privileges and transfer your SSH key.

# Create new admin user
adduser botadmin
usermod -aG sudo botadmin

# Copy SSH keys from root to new user
rsync --archive --chown=botadmin:botadmin ~/.ssh /home/botadmin

2. Harden the SSH Daemon

Disable root login and password-based authentication to block brute-force SSH attacks. Edit /etc/ssh/sshd_config with the following settings:

Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers botadmin

Test configuration syntax and restart SSH (keep your current session open in a separate window to test connection):

sudo sshd -t && sudo systemctl restart ssh

3. Configure Firewall Rules (UFW)

Trading bots typically only require outbound network access to exchange REST and WebSocket APIs (TCP port 443). Drop all unsolicited inbound traffic except on your custom SSH port.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp
sudo ufw enable

4. Install Fail2ban and Automatic Security Updates

Automate patch management for critical vulnerability fixes and block malicious IP behavior.

sudo apt update && sudo apt install fail2ban unattended-upgrades -y
sudo systemctl enable --now fail2ban
sudo dpkg-reconfigure --priority=low unattended-upgrades

Check Fail2ban status:

sudo fail2ban-client status

5. Isolate Bot Environment and Credentials

Limit the operational scope of your code to reduce the impact of potential script or dependency exploits.

• Unprivileged Execution: Create an unprivileged user specifically for running the bot process: sudo useradd -m -s /bin/bash botrunner.
• Restricted Secrets: Store API credentials in environment variables or a .env file. Enforce tight permissions: chmod 600 /path/to/.env.
• Exchange API Scoping: In your exchange account, restrict API key permissions to your specific static VPS IP address. Never enable API withdrawal rights unless strictly necessary.

6. Deploy Process Hardening via Systemd

Manage the bot process using systemd to ensure automatic restarts while applying kernel-level security flags. Example file at /etc/systemd/system/tradingbot.service:

[Unit]
Description=Trading Bot Service
After=network.target

[Service]
Type=simple
User=botrunner
WorkingDirectory=/opt/tradingbot
ExecStart=/opt/tradingbot/venv/bin/python main.py
Restart=on-failure
RestartSec=10
ProtectSystem=full
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

Apply and start the systemd unit:

sudo systemctl daemon-reload
sudo systemctl enable --now tradingbot

Need this done? We handle this hands-on at GuardLabs — get in touch for a quote.