Related

Can DigitalOcean staff access the files on my droplet? Question Question
Access droplet from mac (with ssh key) and from windows with password Question Question

Question

How to secure a droplet previously used for web hosting?

Posted March 8, 2019 2.3k views
SecurityUbuntu 18.04

This is probably a stupid question but I’m being a little paranoid here.

So I previously used my droplet to host my website. I do not recall exactly what I installed to get this to happen, but it included nginx and pm2.

Anyway, I no longer wish to use my droplet for hosting, instead I want to use it to store confidential files. I am concerned that having previously opened my droplet up to being a web host has left doors open to increase the risk of my files being exposed to the internet.

Given that I previously used my droplet for hosting, is there anything y'all would advise to help lock down my droplet? Even if I hadn’t used it for hosting, is there stuff I could do?

So far the only thing I’ve done is uninstall nginx.

I know the obvious answer is to create a new droplet from scratch, but this droplet has a bunch of installations that I want to keep.

Add a comment
mcplums
By:
mcplums

Related

Can DigitalOcean staff access the files on my droplet? Question Question
Access droplet from mac (with ssh key) and from windows with password Question Question

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
2 answers
jarland March 8, 2019

Greetings!

Great question. There is no one-size-fits-all answer on this, but I can tell you what I would do. First, I would check to see what services are listening with this:

netstat -tulpn

Then I would review everything that comes up. You should know what each thing is and whether or not you need it. If you don’t need it, uninstall it. If it’s listening on 127.0.0.1, it doesn’t much matter (since we’re not talking about a shared system). Feel free to compare this against a new droplet to see what is normal to have running by default.

Basically if it’s listening on the public IP or 0.0.0.0 (all interfaces), that is something someone can potentially interface with externally. If it’s listening on 127.0.0.1, you need to already be inside of the server to access it. If it’s not listening, no one can interface with it externally.

If in doubt, it never hurts to just spin up a new server or wipe the OS from the Destroy tab after clicking on the droplet at cloud.digitalocean.com.

Jarland

Reply Report
mcplums March 11, 2019

Thanks very much for this. So, I tried the command you suggested, and the list is identical to what I get when trying the same command on a brand new droplet. I assume this means I have nothing to worry about?

However, there is an entry with 0.0.0.0 in both local and foreign address, with state listen- should I be concerned?

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help