Security Tips and Suggestion - Dokku - Node.js App

Question

Hello,

I’ve recently moved from Heroku to a droplet running Dokku which runs my node.js web app.

I’d like to ask what security suggestions I should follow to minimise any risk of getting hacked.

As its a web app, I’m a little unsure as it needs to be accessible to the world - but how to I secure.

So far:

Ive disabled root login.
Created a new sudo account
Disabled password logins/only ssh keys
Unsure about firewall - what rules etc I should have?

Any help and advice would be appreciated.

Thanks!

Jonathan Tittle · Accepted Answer

@psmod2 The first steps I normally perform are updating the packages and upgrading current packages to make sure everything that’s default is up to date. sudo apt-get update \ && sudo apt-get -y upgrade Once that’s done, I’ll handle setting up a new user, add them to the sudo group, and test that the user is able to actually use sudo to escalate and run commands that would otherwise require root. If all is well there, then I’ll setup firewall rules. Since you’re using Ubuntu, this is super easy. We can use ufw and ultimately, we would setup a default policy to deny any connection that we don’t allow through with rules we’ll add afterwards. So, first we should make sure ufw is not enabled. sudo ufw status If it returns enabled, run sudo ufw disable, otherwise well go ahead and setup our default deny. sudo ufw default deny Now, to setup our rules, we need to figure out what ports we need open for public access. We need at least SSH, HTTP, and HTTPS. sudo ufw allow 22/tcp \ && sudo ufw allow 80/tcp \ && sudo ufw allow 443/tcp We’re using /tcp to define the connection type. This means that we only want to allow connections on these ports using TCP (not UDP). Beyond SSH, HTTP, and HTTPS, you would also need to add any rules to cope with connections on other public ports. So, for example, if you needed remote database access to MySQL, you’d have to open that port up as it’d be blocked with just the above rules in place. Once all rules are set, we then need to enable the firewall. sudo ufw enable It’ll ask you if you really want to enable and that enabling may cause your current connection to drop. Type y and hit enter. As long as SSH has been setup (as shown above), the connection won’t drop. Beyond a Firewall, there’s also fail2ban, which is useful. Setting it up requires a little more, though it’s definitely something to consider. I would also make sure directory and file permissions are properly setup – that is, files should have a chmod of 644 and directories 755. Also, proper ownership of files and directories should be set as you don’t want public files being served by the root user. I even tend to go a step further and only serve files and directories from a non-root, non-sudo user. Just a basic, unprivileged, non-shell user that can’t do anything other than own files and directories.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Security Tips and Suggestion - Dokku - Node.js App

Related questions

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings

Report this

Security Tips and Suggestion - Dokku - Node.js App

Related questions

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings