Absolute basic security steps you should take once you got yourself a server

Intro:
This is going to cover the very basics about what you should do once you have got yourself your first server ( be it a root server or a v-server)

I am not going to throw it inside of a hide tag, since I think everyone should be able to access it, regardless of their points.
But I am going to throw one below in case you want to thank me.


The first thing to keep in mind is that you are responsible for your server.
If it gets hacked and someone uses it to do illegal things (be it spamming, dosing, attempting to bruteforce other systems or even using it to host/download child-porn) at the end of the day the provider is going to refer whoever sends a abuse mail or comes along with a warrant to you.
And you will have to explain to them what you did and how you did it.

Of course your primary goal should be to avoid getting there.

I will not be able to cover a lot of things here, but I can give you some hints into the right direction.


Think about it long and hard:
Keeping a server requires quite a bit of time, effort and knowledge.
I strongly recommend that you start by running a vm on your pc to get used to linux operating systems.
Go through the steps I outlined below.
Make sure you understand them.


SSH-Key-Authentication:
When you get a server, it is usually configured with a root password.
If you generate a ssh key pair, configure ssh key authentication and disable password authentication, that will pretty much prevent brute force attacks from being successful.

A example how to do that is here:


Disable password authentication afterwards, but ensure that the ssh key authentication works (a common pitfall are incorrect permissions on the .ssh folder or the authorized_keys file; Make sure only your own user can write to them)

In addition, you could setup a two factor authentication (you can save the ssh private key on a yubikey or smartcard; or alternatively use otp with the yubikey)
But for most servers the security provided by ssh key authentication is sufficient.


Set up a Firewall:
Setup a inbound firewall (must) and possibly a outbound firewall (should)

The easiest option available is ufw.



You can also look into iptables. Its has a higher difficulty compared to ufw, but it can do few more things.

The exact setup depends on the services you want to run and the firewall you choose.


Regular Updates:
A server isnt something you set up once and just forget.
It needs regular updates.

The lazy option is to use ubuntu server with automatic security updates enabled.
You should definitely do this. There is a very slim chance that a security update is going to break something, but for a private VPS that is acceptable.


Automated Backups:
Make sure you have a working backup strategy.
The backups should be saved on a remote host.
Ideally that backup-host would pull the backups (instead of the server pushing the backup to the remote location)
You should regularly check if that backup strategy is still working.


Fail2Ban:
It is a good practice to setup Fail2Ban or DenyHosts for the services you run on your server.
Both tools will scan the logs generated by your services for bruteforce attacks and then ban the IP of the attackers.
There are ways around that, but it can help against most script-kiddie attacks.


Monitoring / Alerting:
Setup Monitoring / Alerting tools for your server, so you know if there are issues.
For a single server monit is a good choice:https://mmonit.com/monit/

You could also go with icinga or quite a fewother tools, but that is usually overkill.


Regular Maintenance:
Regularly connect to your server and check if there are any updates:
Check your logs if there is anything suspicious or unusual.
Check if your backup is working (if the jobs have been executed and if it cant be restored)


Conclusion:
As i mentioned a few times: Running a server is quite a bit of work.
Make sure to look into the servers you run.
Automate updates whenever possible.

Think about the services you want to host on your machine.
Limit the ports your machine can be accessed with to the absolute necessities.

If you just want to do webhosting, it is usually cheaper to go to a hostingprovider (yes, there are certain limits, but you dont have to bother with the security of the server, isolating different applications, ....)

A few personal recommendations:

• Only get a server if you absolutely have to
  
• Docker can be useful to isolate multiple applications from each other (use official images whenever possible; docker is a good start, but its not everything)
  
• Minimize the number ofservices you run and thereby minimize your exposure.
  
  
• Caddy is nice, especially if you just want to host static files or need a reverse proxy for a few (other) docker containers
  
• Make sure to have someone you can ask if you have questions.
  Dont hesitate to ask them if you are unsure about something.
  
• Dont let any "guru" from the internet access your server because they claim they can fix something.
  
• Be ready to nuke it and start from scratch.
  If you suspect the server might be compromised, nuke it and start over from scratch.
  In that case you should either discard the backup or make sure it is not compromised aswell.
  
• If you want to take it a step further, look into automation. For example ansible, puppet or chef.
  
• It doesn't always have to be wordpress (Jekyll might be sufficient aswell)
  

If youd like me to cover something in more detail or if you spotted a mistake, let me know in topic.

And if you liked it feel free to click on the hide button. (There is nothing important inside; as I explained above)

Very helpful, for me, Fail2ban has blocks millions of attempts to brute force my systems. It could also help to change the default port for some services so it cannot be brute forced as easily as it being the default port.

:lit: It's a beautiful article. I have my own server and protection can be really hard. :lit:

great article, and I admit that it is necessary to keep your server up to date , be secure 3 months before it does not prove that you are safe now, you must always maintain the system and be at current of all hack news

thanks for the hack )))) hope u like my reply love u
:dquestion:

make sure u also get a host with good ddos protection

They protect a whole system. However, it is necessary to keep the server up-to-date and to ensure continuous optimization. A lot of plug-ins installed on the server is old. These plug-ins always make the server vulnerable to security. You have to be careful.

This is some really nice advise!
It was nice to refresh my memory on some of these aspects!

o complete the registration process on Nulled, you will need to go to the URL below in your web browserdsad a asd

keeping server up to date, host with good ddos protection. Thanks for the advice