Question

How to secure a droplet previously used for web hosting?

Posted on March 8, 2019
Ubuntu 18.04 Security
Asked by mcplums

This is probably a stupid question but I’m being a little paranoid here.

So I previously used my droplet to host my website. I do not recall exactly what I installed to get this to happen, but it included nginx and pm2.

Anyway, I no longer wish to use my droplet for hosting, instead I want to use it to store confidential files. I am concerned that having previously opened my droplet up to being a web host has left doors open to increase the risk of my files being exposed to the internet.

Given that I previously used my droplet for hosting, is there anything y’all would advise to help lock down my droplet? Even if I hadn’t used it for hosting, is there stuff I could do?

So far the only thing I’ve done is uninstall nginx.

I know the obvious answer is to create a new droplet from scratch, but this droplet has a bunch of installations that I want to keep.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

jarland

DigitalOcean Employee

• March 8, 2019

Accepted Answer

Greetings!

Great question. There is no one-size-fits-all answer on this, but I can tell you what I would do. First, I would check to see what services are listening with this:

netstat -tulpn

Then I would review everything that comes up. You should know what each thing is and whether or not you need it. If you don’t need it, uninstall it. If it’s listening on 127.0.0.1, it doesn’t much matter (since we’re not talking about a shared system). Feel free to compare this against a new droplet to see what is normal to have running by default.

Basically if it’s listening on the public IP or 0.0.0.0 (all interfaces), that is something someone can potentially interface with externally. If it’s listening on 127.0.0.1, you need to already be inside of the server to access it. If it’s not listening, no one can interface with it externally.

If in doubt, it never hurts to just spin up a new server or wipe the OS from the Destroy tab after clicking on the droplet at cloud.digitalocean.com.

Jarland

mcplums • March 11, 2019

Thanks very much for this. So, I tried the command you suggested, and the list is identical to what I get when trying the same command on a brand new droplet. I assume this means I have nothing to worry about?

However, there is an entry with 0.0.0.0 in both local and foreign address, with state listen- should I be concerned?