Operations¶

This page covers how the instance is secured, and how to manage the service, read logs, rotate credentials, back up and upgrade.

Security model¶

The hardening below is built into the image and active on first boot.

Control	Setting
UFW firewall	Deny all inbound by default. Allow TCP 22 only. Allow all outbound.
fail2ban	The `sshd` jail bans an address for 1 hour after 5 failed logins within 10 minutes.
SSH	Key-only: password login off, root login only with a key, X11 forwarding off, at most 3 authentication tries.
Kernel	ICMP redirects off, IP forwarding off.
Instance metadata	IMDSv2 is required.
Updates	Unattended security upgrades, daily, with no automatic reboot.

The image contains no SSH keys and no credentials. Your provider key and Telegram token live only in /home/ubuntu/.hermes/.env, readable only by ubuntu. Hermes runs as ubuntu.

Keep the security group's SSH rule limited to your own address. The UFW firewall and the security group are separate layers; both must stay configured. Use a dedicated provider key and Telegram bot for each deployment.

Manage the service¶

sudo systemctl status hermes-gateway --no-pager
sudo systemctl restart hermes-gateway

The service starts at boot and restarts itself 10 seconds after a crash.

Logs¶

sudo tail -n 80 /home/ubuntu/.hermes/logs/gateway.log   # gateway and Telegram
sudo journalctl -u hermes-gateway -n 100 --no-pager      # service output
sudo journalctl -u hermes-gateway -f                     # follow live
sudo tail -n 80 /var/log/deploy-ec2.log                  # provisioning runs

Also watch the EC2 status checks, your model provider's quotas and Telegram connectivity.

Rotate credentials¶

Create a new provider key or Telegram bot token.
Run the provisioning script again with the new values.
Check the agent replies, then revoke the old key or token.

Backups¶

Configuration, credentials, sessions, cron jobs and state are all in /home/ubuntu/.hermes. Take an EBS snapshot of the root volume, or back up that directory only:

sudo tar -czf hermes-backup.tar.gz -C /home/ubuntu .hermes

Warning

A backup that includes .env contains your credentials. Store it encrypted.

Updates and upgrades¶

Operating system. Security updates install daily. The instance does not reboot itself; reboot when an update needs it.
Hermes. Each image version bakes one Hermes release; there is no in-place upgrade. To move to a newer version, back up /home/ubuntu/.hermes, launch a new instance from the newer Marketplace version, provision it, and copy across only the state you need. Your old instance keeps running untouched until you terminate it.

Stop and start¶

Stopping the instance stops the hourly software charge; terminating it also stops paying for the disk. Starting it again gives it a new public IP address unless you attach an Elastic IP. The agent starts by itself.

Support¶

Email info@softwaresushi.com with your instance ID, the image version and what you see. Never send keys or tokens. For security reports, use the subject Hermes AI Agent security.