How secure are the preconfigured Droplets (e.g. Ghost installation)?

October 31, 2014 2.2k views

I'm planning on spinning up a Ghost blog ( just for fun.

I don't really have the time to do a manual installation (unfortunately), so I'm planning on going with one of the preconfigured Ghost droplets.

How secure are these installations (have they been hardened, should I expect my blog to be readily hacked,...)?


2 Answers

You should put additional security measures in place from the ground up.
For instance you could explore:

Setting up SSH keys and spinning up your droplets with them.

Setting up UFW on your droplet is an easy way to configure IP Tables.

You could configure port knocking for some obscurity of your ssh access but setting up ssh keys is usually good enough.

PS: Already It's been said that Ghost is more secure than other popular blogging platforms.

SSH keys provide a more secure way of logging into a virtual private server with SSH than using a password alone. With SSH keys, users can log into a server without a password. This tutorial explains how to generate, use, and upload an SSH Key Pair.

I just did this recently and one thing definitely stood out to me when I was following the tutorial for using Ghost with Digital Ocean.

Once it's set up you barely have to do any configuration; if I remember correctly the only thing I had to do was set up my server name. However, the problem is that the droplets don't have HTTPS support by default, since they can't set it up for you, so you should probably get an SSL certificate and enable HTTPS so that the admin login page won't be done through HTTP.

Have another answer? Share your knowledge.