[Security Enhancement] Permitting root login only from localhost/docker or specific ips

[spathizilla]

This is mostly just a suggestion in documentation improvements rather than anything in Coolify itself.

In the worst case event of a root ssh privkey leakage from Coolify, it would be possible for someone to take over servers. Obviously no one wants that. I have never liked allowing root login from anywhere as sudo works fine but Coolify needs to use it.

It is possible to configure sshd to allow root privkey usage for a very specific set of addresses which then disallows the key from anywhere else. This would mean any leaked privkeys become basically useless. In this example I have set it to allow from localhost and docker containers (for Coolify where used on the same machine).

In sshd_config I have PermitRootLogin set to no.
In sshd_config (at the end of the file - this is important):

Match address 127.0.0.1
        PermitRootLogin prohibit-password
Match address 10.0.0.0/8
        PermitRootLogin prohibit-password
Match All

Other rules could be added where Coolify is running on a different server in the same format of "Match address ".
The Match All is just there as a catchall for anything else.

I have this already implemented with my Coolify instance and the servers it manages.
This is mostly aimed at deployments not using the Coolify Cloud as I'd guess that has way more ips in use.

[jeroenvdmeer]

Totally agree. Requiring Coolify to login as root goes against baseline security practices. CIS benchmark for Ubuntu 24.04 has a specific Level 1 requirement for this: Disable SSH Root Login. Their rational is as follows:

Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account provides individual accountability of actions performed on the system and also helps to minimize direct attack attempts on root's password.