@SwissCheese

Always happy to help!

I got my start about 16 years ago, so I know how you feel :-). One word of advice is to begin researching server security. By default, DigitalOcean provides a bare OS, so you’re really on your own and will need to ensure that proper OS updates are maintained, upgrades are performed when security patches are released, etc.

The OS package manager makes this rather easy for the most part, though there will come a time where experience with the CLI is the only way to handle an issue.

A prime example is when dealing with software that isn’t in the OS repository or a third-party repo (i.e. compiling from source), managing logs (server, firewall, ect), mitigating an incoming attack (see rate-limiting requests) and various other items (far too many for a reply as everything is its own subject or sub-category).

Starting out, I’d secure SSH by locking it down as much as possible. The base port, 22, is well-known and will be the first port that someone tries to hit in an attempt to break in to your server. Changing the port is security through obscurity and not the most recommended route, though it’s a simple step to help when combined with a firewall and a firewall rule to block any/all access on 22 and only allow SSH through the new port.

Ideally, you’ll want to setup firewall rules to deny all access by default and only allow access to ports that you specifically allow using individual rules.

Setting Up UFW on Ubuntu

For example, Ubuntu offers a simple firewall that overlays iptables (the standard firewall) – it’s called ufw (short for Uncomplicated Firewall). What I’d recommend is running the following to get started.

Disable UFW If Enabled

You’ll want to run this first and foremost as if ufw is enabled, the next command will lock you out. The output of the last command should read: Status: inactive

ufw disable && ufw status

Deny All Connections

Simply put, this tells the firewall to deny any connection attempt, regardless of port or access level (including root). For that very reason, that’s why we must run the above command to disable ufw before setting a default rule to deny all connections.

ufw default deny

Allow SSH on Port 22

This will allow you to keep your connection once we enable ufw.

ufw allow 22/tcp

Allow HTTP, HTTPS, and DNS

Connections over HTTP and HTTPS are made via tcp, so you’ll definitely want to allow those, otherwise any attempts to access your websites are going to be denied. Standard connections aren’t made via udp, so we don’t need to specifically allow ports 80 and 443 to accept connections via udp, thus only tcp is being specified (and udp attempts will be blocked).

You’ll notice that for 53, the default DNS port, both tcp and udp connections are specified as being allowed. This is because the OS package manager need to be able to resolve requests being made outside the server, otherwise you may run in to issues updating, upgrading and installing packages.

ufw allow 80/tcp \
&& ufw allow 443/tcp \
&& ufw allow 53/tcp \
&& ufw allow 53/udp \

Enable UFW

ufw enable

You’ll see a message:

Command may disrupt existing ssh connections. Proceed with operation (y|n)?

Simply enter y and hit enter. The firewall is now active and will now intercept all incoming requests and unless the access port is 80, 443, 22, or 53, it will be denied and logged.

That’s a very basic start, but any server, regardless of type, should be running a firewall as a first-step measure against unwanted access. This being a very basic and short how-to, you should go beyond the above, if possible. Specifically, if you have a Static IP from your ISP, you can further restrict access on Port 22 by only allowing access from that IP, thus denying any connection period, unless it’s from your IP.