# Security your server checks for itself.

> Unrent never holds an SSH key or password for your servers. The agent connects out, accepts only signed jobs with a fixed schema, and verifies a passkey approval itself before anything destructive, so even a compromised Unrent cannot destroy your data.

URL: https://unrent.dev/features/security/

## What Unrent can and cannot do

- **No inbound access**: The agent dials out over a websocket. There is no listening port, no SSH key and no remote shell.
- **Signed, typed jobs**: Every action is a job kind with a strict schema, signed for your organisation. Commands are built from typed fields, never strings.
- **Passkey approvals**: Restoring over production, changing where backups go or downgrading the agent needs an approver’s passkey over that exact job, checked by the server.
- **Secrets sealed in your browser**: Values are encrypted to keys only your servers hold. Unrent stores ciphertext and cannot read it.
- **Two processes on the server**: `unrentd` talks to the network without privileges. The root helper `unrent-exec` has no network and re-checks every signature.
- **Tamper-evident audit**: Every job, approval and result is recorded in a hash chain with the server’s own signature on results, and can be exported and verified offline.

## Server hardening you can read before it runs.

On Ubuntu 24.04 or 26.04, or Debian 12 or 13 (amd64 or arm64), Unrent checks eight things and shows a plan of every change before applying it: firewall, SSH (no passwords, no root password login, with a lock-out guard), unattended upgrades, Docker live-restore and log limits, swap, time sync, journal size, and a firewall for published container ports that Docker cannot bypass (it also keeps containers away from the cloud metadata address).

The agent re-checks every night and raises an alert if a hardened server drifts.

> **Coming:** A reboot window for kernel updates.