Massed Compute

Running production workloads on cloud VMs requires proper security hardening. This guide walks you through securing Ubuntu VMs on Massed Compute with SSH key authentication, firewall configuration, and automatic security updates.

You’ll disable password authentication, configure UFW firewall, enable unattended security updates, and register the VM in a protection registry to prevent accidental termination during long-running projects.

Pricing fetched from the Massed Compute inventory API on June 23, 2026.

View live GPU cloud pricing →

Deploy and Harden Your VM

# Wait for instance to reach running state
# Note: YOUR_VM_IP, ubuntu, and port 22

chmod 600 .env 2>/dev/null || true
chmod 600 ~/.ssh/vm-hardening-key 2>/dev/null || true

# Scan for accidentally committed secrets
rg -n 'sk-[A-Za-z0-9]{10,}|Bearer [A-Za-z0-9._-]{20,}|password\s*=\s*[^<]' \
  --glob '!.env' --glob '!instances/*' --glob '!.venv' . || true

# Generate new SSH key
ssh-keygen -t ed25519 -f ~/.ssh/vm-hardening-key -N "" -C "vm-hardening@massedcompute"

# Copy public key to VM
ssh-copy-id -i ~/.ssh/vm-hardening-key -p 22 ubuntu@YOUR_VM_IP

# Test key-based login in second terminal
ssh -i ~/.ssh/vm-hardening-key -o BatchMode=yes -p 22 ubuntu@YOUR_VM_IP 'echo SSH_KEY_OK'

sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
echo 'PubkeyAuthentication yes' | sudo tee -a /etc/ssh/sshd_config.d/99-hardening.conf
sudo systemctl reload ssh

# Update package lists and upgrade system
sudo apt-get update
sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y

# Enable unattended security updates
echo 'unattended-upgrades unattended-upgrades/enable_auto_updates boolean true' | sudo debconf-set-selections
sudo apt-get install -y unattended-upgrades
sudo DEBIAN_FRONTEND=noninteractive dpkg-reconfigure -f noninteractive unattended-upgrades

# Allow SSH and enable firewall
sudo ufw allow OpenSSH
sudo ufw --force enable
sudo ufw status

# Verify status shows "Status: active"
sudo ufw status | grep -q 'Status: active' && echo "Firewall active" || echo "Firewall setup failed"

# Create protection registry entry (local file)
echo '{"uuid": "YOUR_INSTANCE_UUID", "name": "vm-hardening-lab", "note": "persistent storage vault", "protectedSince": "2026-06-23"}' >> ~/vm-protection-registry.json

Troubleshooting

SSH Connection Issues

• Host key changes: Run ssh-keygen -R YOUR_VM_IP and confirm the instance is running
• Locked out after disabling passwords: Use the Massed Compute console to re-enable password auth temporarily and fix authorized_keys
• Key permissions: Ensure private key is chmod 600 and owned by your user

Firewall Problems

• UFW shows inactive: Run sudo ufw --force enable and verify status again
• Service ports blocked: Use sudo ufw allow PORT/tcp for project-specific ports
• SSH locked out: Use the VM console to disable UFW: sudo ufw disable

Update Issues

• Package conflicts: Run sudo apt-get -f install to fix broken dependencies
• Unattended upgrades not working: Check /var/log/unattended-upgrades/ for errors
• Kernel updates require reboot: Schedule maintenance windows for kernel updates

Skip All of This: Deploy with an AI Agent

This guide exists as a tested, machine-readable recipe in the Massed Compute MCP. Instead of following the manual steps above, you can have an AI agent handle the entire VM hardening workflow for you.

Add this MCP server to your AI agent configuration:

{
  "mcpServers": {
    "massed-compute": {
      "type": "http",
      "url": "https://vm.massedcompute.com/api/mcp",
      "headers": { "Authorization": "Bearer MC_TOKEN" }
    }
  }
}

The agent will match your request against the recipe catalog, provision the right VM shape, run all the setup and verification steps above, and report back with the result. If any step fails, the process stops and you get the exact error output.

Recipe tested on June 10, 2026.

Quick Setup Guide

1. Launch VM: Deploy Ubuntu 24.04 on Massed Compute with 2+ vCPUs and 4+ GB RAM
2. Generate keys: Create Ed25519 SSH key pair locally
3. Test access: Verify key authentication in second terminal session
4. Harden SSH: Disable password auth and root login
5. Update system: Apply patches and enable automatic security updates
6. Configure firewall: Enable UFW with SSH-only access
7. Register protection: Add VM to local protection registry

Frequently Asked Questions