Get alerted when assets are down, slow, or vulnerable to SSL attacks—all free for a month. Learn more

Question

What is your server security check list?

Locking down the root acount, using SSH keys, installing fail2ban, and setting up a basic firewall are all things we should be doing in the first five minutes on a new server. After these basics, what other steps do you take to harden your servers? Are there security utilities that you consider essential? Have you implemented any intrusion detection?

Let’s share what’s on our server security check lists.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

justincf • November 30, 2016
  1. Password-less logins.
  2. Change SSH port – no need for fail2ban then.
  3. Close all ports by default, and then manually open individual ports that are needed.
  4. Related to #3 limit access to open ports (by source/destination) wherever possible.
  5. Remove all unnecessary packages/services that came preinstalled.
  6. Update all packages, restart the entire server (assuming some of them may need it).

Those are the basics I always run.

kyroskoh • December 5, 2016

I usually recommend people to follow “CIS Security Benchmarks”, for example for Ubuntu 14.04

Adam Robertson • December 2, 2016

Related to security in an after-the-fact sort of way: Backups…lots of backups. Regular backups of your web-folders and databases in different folders for different times. Have those backups initiated from a different server that ssh’s into the droplet and backs up things then disconnects.

Also: a snapshot of your droplet in a working state.

If your server is compromised, or crashes …you can spin-up a droplet from that image and then restore your web-folder and databases from the most recent backup.

Try DigitalOcean for free

Click below to sign up and get $100 of credit to try our products over 60 days!

Sign up