Securing my installation

[tbobkermux]

If I followed the installation and then just use ssh tunnelling, is there anything else I need to do to secure my server?

Should I use ubuntu firewall (ufw), denyhosts etc and what should I be aware of if I am using my hosted code-server on a digital ocean droplet to access my shared hosting on another service using sftp?

[jsjoeio]

cc @oxy

(Also, we may want to revisit the docs if there are more changes that should be made)

[tbobkermux]

So does this mean it's secure enough as is?

I think I'll do the usual: disable ssh login, denyhosts, change default ssh port and then ufw. That coupled with port forwarding it should be quite secure.

I was also wondering what I need to consider if I am using features like git and managing projects on github, additional extensions etc.

[jsjoeio]

I think it should be but I'm hoping @oxy can provide any additional suggestions.

[oxy]

Sorry about being so late; email was piling up and I only just got around to cleaning up all the GH notifications;

One concern unique to code-server is that other server software on the same instance can connect to code-server and use it to elevate privileges - ensure that your config file (~/.config/code-server/config.yaml) is set to 0600, and that "untrusted"/high risk services run as separate users that do not have access to the file.

Otherwise, I don't think there's much else to do - SSH tunneling is definitely a safer option than exposing code-server directly.

[aptalca]

If you do expose code-server on a VPS (I do), you can add another layer of protection via a reverse proxy and 2fa. I use SWAG (nginx based rp) and Authelia for that: https://blog.linuxserver.io/2020/08/26/setting-up-authelia/
Here's the SWAG proxy conf for code server that covers proxied subdomains as well: https://github.com/linuxserver/reverse-proxy-confs/blob/master/code-server.subdomain.conf.sample

[viharm]

If you do expose code-server on a VPS (I do), you can add another layer of protection via a reverse proxy and 2fa. I use SWAG (nginx based rp) and Authelia for that: https://blog.linuxserver.io/2020/08/26/setting-up-authelia/ Here's the SWAG proxy conf for code server that covers proxied subdomains as well: https://github.com/linuxserver/reverse-proxy-confs/blob/master/code-server.subdomain.conf.sample

Thanks for confirming that it works with Authelia. Does code-server accept the default headers (Remote-User, Remote-Groups, etc.) forwarded by Authelia? Is there any other config needed?