Best practices for cluster security

To secure your Virtuozzo Hybrid Infrastructure cluster and prevent possible compromise of the system, follow these guidelines:

Use a strong password for the default admin user. You can change the existing password after the product installation, as described in Managing admin panel users.
Use a strong password for the root user on each cluster node. You can change the existing password for a node by using the passwd command. For example:
```
# passwd
Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
```
Use a separate and isolated network for the admin panel and SSH access. You can assign traffic types to infrastructure networks and assign networks to node network interfaces, as described in Managing traffic types and Changing network interface parameters.
Configure inbound firewall rules to limit the admin panel and SSH access, as described in Configuring inbound firewall rules.
Prohibit password authentication for SSH access. You can add an SSH key, as described in Securing root access to cluster nodes over SSH.

Once the key is added, you can access nodes via SSH and disable password authentication in the sshd configuration file:
1. Open the /etc/ssh/sshd_config file for editing and set PasswordAuthentication to no:
```
# vi /etc/ssh/sshd_config
```
2. Check that your changes are successfully applied:
```
# grep ^PasswordAuthentication /etc/ssh/sshd_config
PasswordAuthentication no
```
3. Restart the service:
```
# systemctl restart sshd
```
For more information, refer to the sshd_config manual page.
[For backup storage] Configure the latest TLS version and only desired ciphers to be used for connections to backup storage, as described in Changing TLS configuration for backup storage.
[For object storage] Configure desired TLS version and ciphers to be used for connections to object storage, as described in Changing the TLS configuration for S3.
Use only necessary traffic types in a public network, according to the deployed services. You can reassign traffic types, as described in Managing traffic types.

For more information about network ports used for different services and associated with traffic types, refer to Network ports.