KI-Server-Sicherheit: Hardening für LLM-Deployments

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication only
AllowUsers admin
MaxAuthTries 3

# Firewall aktivieren
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp  # SSH
sudo ufw allow 8000/tcp # vLLM API
sudo ufw allow 3000/tcp # Open WebUI
sudo ufw enable

# docker-compose.yml: Nicht-root Benutzer
services:
  llm:
    user: "1000:1000"
    read_only: true
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./models:/models:ro

KI-Server (10.0.0.10)
├── SSH: Nur aus 10.0.0.0/24
├── API: Nur aus 10.0.0.0/24
├── WebUI: Optional öffentlich (Auth!)
└── Keine Internet-Connectivity nötig

# Unusual login detection
sudo journalctl -u sshd --since "1 hour ago" | grep "Failed"

# Network connection monitoring
sudo ss -tunap | grep ESTAB