Skip to main content
A host machine has a public IPv4 address with a range of forwarded ports and serves clients continuously. Several of its configuration settings are verification requirements. These pages give each setting, the command that reports its current value, and the procedure to change it. The steps are the same on Ubuntu Server 22.04 and 24.04.

​
Before you start

These pages assume a fresh Ubuntu Server install on a machine that is not yet listed. Work through them in order before the machine takes its first rental, while no change can interrupt a client.
Do not work through these pages end to end on a machine that is already configured and renting. Several steps close network access, change who can log in, or restart a service. On a machine with instances running, this can disconnect clients mid-workload, lock you out of the machine, or take it offline.On an existing machine, use one page at a time: run the check command, change one setting, confirm the machine is still reachable from outside, then continue. Run the disruptive steps in a maintenance window.
Configuring the machine is the host’s responsibility. Vast does not configure your hardware, network, or operating system. The verification requirements list what the platform checks automatically; these pages are the setup those requirements assume.Completing these pages does not guarantee verification. Machines also fail or lose verification for reliability, performance, and network reasons unrelated to this configuration.

​
Have a way in that is not SSH

SSH Access and The Host Firewall can both leave the machine unreachable over SSH. Confirm your fallback access works before you begin. If the machine has a BMC — IPMI, iDRAC, or iLO — the BMC console is your fallback. Log in to it now to confirm it works. If the machine has no BMC, which is common on consumer and workstation boards, the fallback is a monitor and keyboard attached to the machine. If you cannot reach the machine physically, schedule an automatic undo before each change. This runs ufw disable in ten minutes:
Make the change, open a new connection from outside to confirm the machine is still reachable, then cancel the undo:
If the change locks you out instead, the timer runs and you can reconnect.
An SSH tunnel to the BMC is not a fallback. A tunnel requires a working SSH connection, which is what these changes can break. Reach the BMC over its own network connection.

​
Setting up a machine

Work through these in order on a new machine.

SSH Access

Key-only login, a unique key pair per machine, and removing keys no longer in use

Accounts and Sudo

Who can log in, who can become root, and removing unused accounts

The Host Firewall

What ufw covers, what Docker handles instead, and verifying from outside

Management Interfaces

BMC, IPMI, iDRAC, and iLO credentials, and keeping them off the public internet

Disable Automatic Updates

Stop the machine installing updates outside a maintenance window

​
If something goes wrong

Recovery

Undo a change that locked you out: SSH config, keys, firewall rules, accounts

Offline Machine

Diagnose a machine that has dropped off the marketplace