Security
Secure by default, on your server and on your computer
Coxios applies server administration best practices to your VPS, and keeps your keys and passwords on your machine. Here is exactly what it does.
What Coxios installs on your server
The setup assistant applies these protections one by one. You see every command and approve it before it runs.
A protected user
A dedicated account with admin rights and your SSH key. No more logging in as root.
Hardened SSH
Direct root login and password login turned off. This step always requires explicit confirmation, and Coxios first checks that your key works so you never lock yourself out.
An active firewall
ufwon Ubuntu and Debian,firewalldon the Red Hat family. Only SSH and web ports stay open, and you manage the rules from the app.Fail2ban against bots
Addresses that pile up failed login attempts get blocked automatically. The app shows how many are blocked right now.
A hardened kernel
Safe network settings (
sysctl) against SYN floods, IP spoofing and kernel information leaks.Automatic security updates
unattended-upgradesordnf-automaticinstall system security patches on their own.
On-demand security audit
From the Security tab, a quick scan (about twenty seconds) or a deep one reviews your server and tells you, in plain words, what needs your attention:
- firewall inactive or fail2ban missing;
- root or password login still allowed over SSH;
- pending security updates;
- exposed ports and services listening on the internet;
- today's failed login attempts;
- suspicious SUID files and Docker containers in privileged mode;
- expired or soon-to-expire HTTPS certificates;
- in a deep scan: system hardening score (Lynis) and known vulnerabilities in your Docker images (Trivy), tools installed on demand.
Continuous monitoring
Between audits, Coxios keeps reading what protects your server: firewall, fail2ban, listening ports, certificates and their renewal. The result fits in one sentence, and anything that needs action stands out immediately.
Every change Coxios makes to a sensitive file (proxy configuration, compose file, variables) is backed up first, validated, then rolled back if it doesn't hold.
How the app protects your access
Coxios is a desktop application. Your servers are driven from your computer, not from an online service.
Your keys stay with you
SSH keys live in
~/.sshon your computer. Coxios only reads a private key for the length of a connection, and never sends it anywhere.Secrets encrypted by your system
Passphrases go into the system keychain. Other secrets (Git tokens, webhook secrets) are encrypted with a key held by the keychain: a copy of the local database on another machine stays unreadable.
No agent on your server
Coxios only uses SSH. Nothing runs permanently for it on your VPS, and you can uninstall it without leaving a daemon behind.
Verified server fingerprints
Each server is recognized by its SSH fingerprint. If it changes, Coxios asks you to confirm. These fingerprints are stored separately, without touching your
~/.ssh/known_hosts.Nothing from your servers on our side
Addresses, credentials, content and logs of your servers stay on your computer. Anonymous usage statistics are off by default and only turn on if you choose so in settings.
Account sign-in without a password in the app
You sign in to your Coxios account in your browser. The app only receives a session token, which it stores encrypted. No account password is ever typed into the app.
A sandboxed app
The interface runs in a sandbox isolated from the system, with a strict content security policy. The app is signed and notarized by Apple.
App lock
Turn on Touch ID or a code to open Coxios, and to confirm irreversible actions like deleting a server or a user.
Payment
Subscriptions are sold and collected by Lemon Squeezy, our official reseller, which accepts cards and PayPal. You enter your payment details only on their side: we never see or store your card number.