How to secure a droplet previously used for web hosting?

March 8, 2019 1.5k views
Security Ubuntu 18.04
mcplums
By:
mcplums

This is probably a stupid question but I'm being a little paranoid here.

So I previously used my droplet to host my website. I do not recall exactly what I installed to get this to happen, but it included nginx and pm2.

Anyway, I no longer wish to use my droplet for hosting, instead I want to use it to store confidential files. I am concerned that having previously opened my droplet up to being a web host has left doors open to increase the risk of my files being exposed to the internet.

Given that I previously used my droplet for hosting, is there anything y'all would advise to help lock down my droplet? Even if I hadn't used it for hosting, is there stuff I could do?

So far the only thing I've done is uninstall nginx.

I know the obvious answer is to create a new droplet from scratch, but this droplet has a bunch of installations that I want to keep.

Log In to Comment
2 Answers
jarland MOD March 8, 2019
Accepted Answer

Greetings!

Great question. There is no one-size-fits-all answer on this, but I can tell you what I would do. First, I would check to see what services are listening with this:

netstat -tulpn

Then I would review everything that comes up. You should know what each thing is and whether or not you need it. If you don't need it, uninstall it. If it's listening on 127.0.0.1, it doesn't much matter (since we're not talking about a shared system). Feel free to compare this against a new droplet to see what is normal to have running by default.

Basically if it's listening on the public IP or 0.0.0.0 (all interfaces), that is something someone can potentially interface with externally. If it's listening on 127.0.0.1, you need to already be inside of the server to access it. If it's not listening, no one can interface with it externally.

If in doubt, it never hurts to just spin up a new server or wipe the OS from the Destroy tab after clicking on the droplet at cloud.digitalocean.com.

Jarland

Reply
mcplums March 11, 2019

Thanks very much for this. So, I tried the command you suggested, and the list is identical to what I get when trying the same command on a brand new droplet. I assume this means I have nothing to worry about?

However, there is an entry with 0.0.0.0 in both local and foreign address, with state listen- should I be concerned?

Reply
Have another answer? Share your knowledge.

Related Questions