Question
How to secure a droplet previously used for web hosting?
- Posted March 8, 2019
- SecurityUbuntu 18.04
This is probably a stupid question but I’m being a little paranoid here.
So I previously used my droplet to host my website. I do not recall exactly what I installed to get this to happen, but it included nginx and pm2.
Anyway, I no longer wish to use my droplet for hosting, instead I want to use it to store confidential files. I am concerned that having previously opened my droplet up to being a web host has left doors open to increase the risk of my files being exposed to the internet.
Given that I previously used my droplet for hosting, is there anything y’all would advise to help lock down my droplet? Even if I hadn’t used it for hosting, is there stuff I could do?
So far the only thing I’ve done is uninstall nginx.
I know the obvious answer is to create a new droplet from scratch, but this droplet has a bunch of installations that I want to keep.
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Greetings!
Great question. There is no one-size-fits-all answer on this, but I can tell you what I would do. First, I would check to see what services are listening with this:
netstat -tulpn
Then I would review everything that comes up. You should know what each thing is and whether or not you need it. If you don’t need it, uninstall it. If it’s listening on 127.0.0.1, it doesn’t much matter (since we’re not talking about a shared system). Feel free to compare this against a new droplet to see what is normal to have running by default.
Basically if it’s listening on the public IP or 0.0.0.0 (all interfaces), that is something someone can potentially interface with externally. If it’s listening on 127.0.0.1, you need to already be inside of the server to access it. If it’s not listening, no one can interface with it externally.
If in doubt, it never hurts to just spin up a new server or wipe the OS from the Destroy tab after clicking on the droplet at cloud.digitalocean.com.
Jarland
Try DigitalOcean for free
Click below to sign up and get $100 of credit to try our products over 60 days!
Thanks very much for this. So, I tried the command you suggested, and the list is identical to what I get when trying the same command on a brand new droplet. I assume this means I have nothing to worry about?
However, there is an entry with 0.0.0.0 in both local and foreign address, with state listen- should I be concerned?