Unmanaged Server Security - Revision history

Jab at 17:07, 26 February 2019

2019-02-26T17:07:51Z

← Older revision		Revision as of 11:07, 26 February 2019
Line 41:		Line 41:
	[[Category:Getting Started]]		[[Category:Getting Started]]
	[[Category:Cloud_Hosting]]		[[Category:Cloud_Hosting]]
	~~{{:Cloud Hosting}}~~

Boom at 22:55, 16 November 2016

2016-11-16T22:55:13Z

← Older revision		Revision as of 16:55, 16 November 2016
Line 40:		Line 40:
	[[Category:Hosting Troubleshooting]]		[[Category:Hosting Troubleshooting]]
	[[Category:Getting Started]]		[[Category:Getting Started]]
			[[Category:Cloud_Hosting]]
	{{:Cloud Hosting}}		{{:Cloud Hosting}}

Boom: /* 5. Automatic Security Updates */

2016-11-16T22:18:04Z

5. Automatic Security Updates

← Older revision		Revision as of 16:18, 16 November 2016
Line 36:		Line 36:


			--------------
	[[Category:Troubleshooting]]		[[Category:Troubleshooting]]
	[[Category:Hosting Troubleshooting]]		[[Category:Hosting Troubleshooting]]
	[[Category:Getting Started]]		[[Category:Getting Started]]
	{{:Cloud Hosting}}		{{:Cloud Hosting}}

Boom: /* 5. Automatic Security Updates */

2016-11-16T22:17:57Z

5. Automatic Security Updates

← Older revision		Revision as of 16:17, 16 November 2016
Line 32:		Line 32:
	* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.		* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.
	* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]		* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]

Boom at 22:17, 16 November 2016

2016-11-16T22:17:37Z

← Older revision		Revision as of 16:17, 16 November 2016
Line 32:		Line 32:
	* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.		* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.
	* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]		* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]


			[[Category:Troubleshooting]]
			[[Category:Hosting Troubleshooting]]
			[[Category:Getting Started]]
			{{:Cloud Hosting}}

Boom: /* 4. iptables */

2016-11-16T00:44:40Z

4. iptables

← Older revision		Revision as of 18:44, 15 November 2016
Line 23:		Line 23:

	==4. '''iptables'''==		==4. '''iptables'''==
	* Simply put, '''iptables''' will be your servers firewall. It will allow or block traffic from IP ~~address~~, ports and protocols.		* Simply put, '''iptables''' will be your servers firewall. It will allow or block traffic from IP addresses, ports and protocols.
	* If there is an offending IP address repeatedly attacking your server through a brute force attempt, iptables will block that connection from being established.		* If there is an offending IP address repeatedly attacking your server through a brute force attempt, iptables will block that connection from being established.
	* You can block entire ports outright from being used for traffic in and traffic out. Perhaps to block FTP and require users to use SFTP instead.		* You can block entire ports outright from being used for traffic in and traffic out. Perhaps to block FTP and require users to use SFTP instead.

Boom: /* 4. iptables */

2016-11-16T00:44:09Z

4. iptables

← Older revision		Revision as of 18:44, 15 November 2016
Line 26:		Line 26:
	* If there is an offending IP address repeatedly attacking your server through a brute force attempt, iptables will block that connection from being established.		* If there is an offending IP address repeatedly attacking your server through a brute force attempt, iptables will block that connection from being established.
	* You can block entire ports outright from being used for traffic in and traffic out. Perhaps to block FTP and require users to use SFTP instead.		* You can block entire ports outright from being used for traffic in and traffic out. Perhaps to block FTP and require users to use SFTP instead.

			sudo apt-get install iptables

	==5. '''Automatic Security Updates'''==		==5. '''Automatic Security Updates'''==
	* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.		* Lastly we recommend that you keep your Ubuntu Cloud Server up-to-date by using a very simply solution named "AutomaticSecurityUpdates". This will help reduce your exposure to day 1-x vulnerabilities that have since been patched.
	* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]		* Ubunutu forums has a great resource on how you can achieve this. We recommend you check it out at: [https://help.ubuntu.com/community/AutomaticSecurityUpdates https://help.ubuntu.com/community/AutomaticSecurityUpdates]

Boom: /* 3. Fail2Ban */

2016-11-16T00:43:57Z

3. Fail2Ban

← Older revision		Revision as of 18:43, 15 November 2016
Line 20:		Line 20:
	* Like the previously mentioned disabling of root ssh, we want to limit the vectors for assailants to brute force usernames and/or passwords. By using a service named '''"Fail2Ban"''' we can mitigate their ability to repeatedly guess your servers usernames and passwords. By temporarily blocking the offending IP address from connecting to your server for a designated amount of time, or just flat outright.		* Like the previously mentioned disabling of root ssh, we want to limit the vectors for assailants to brute force usernames and/or passwords. By using a service named '''"Fail2Ban"''' we can mitigate their ability to repeatedly guess your servers usernames and passwords. By temporarily blocking the offending IP address from connecting to your server for a designated amount of time, or just flat outright.

	sudo apt-get install ~~iptables~~		sudo apt-get install fail2ban

	==4. '''iptables'''==		==4. '''iptables'''==

Boom: /* 3. Fail2Ban */

2016-11-16T00:43:45Z

3. Fail2Ban

← Older revision		Revision as of 18:43, 15 November 2016
Line 18:		Line 18:

	==3. '''Fail2Ban'''==		==3. '''Fail2Ban'''==
	* Like the previously mentioned disabling of root ssh, we want to limit the vectors for assailants to brute force usernames and/or passwords. By using a service named '''"Fail2Ban"''' we can mitigate their ability to repeatedly guess your servers usernames and passwords. By temporarily blocking the offending IP address from connecting to your server for a designated amount of time, or just flat outright.		* Like the previously mentioned disabling of root ssh, we want to limit the vectors for assailants to brute force usernames and/or passwords. By using a service named '''"Fail2Ban"''' we can mitigate their ability to repeatedly guess your servers usernames and passwords. By temporarily blocking the offending IP address from connecting to your server for a designated amount of time, or just flat outright.

			sudo apt-get install iptables

	==4. '''iptables'''==		==4. '''iptables'''==

Boom: /* 2. SSH Keys */

2016-11-16T00:43:01Z

2. SSH Keys

← Older revision		Revision as of 18:43, 15 November 2016
Line 14:		Line 14:
	* SSH keys allow users to SSH to servers with a more secure method rather than having to rely on passwords alone. Passwords can be brute forced, given out, or stolen. SSH keys allow users to store a private key on their local machine, and a public key on their Cloud Server letting them SSH to their Cloud Server without the need for passwords. A SSH key pair consists of a public key and a private key. You can upload your public key on any server, but should keep your private key stored in a protected place preferably with a passphrase.		* SSH keys allow users to SSH to servers with a more secure method rather than having to rely on passwords alone. Passwords can be brute forced, given out, or stolen. SSH keys allow users to store a private key on their local machine, and a public key on their Cloud Server letting them SSH to their Cloud Server without the need for passwords. A SSH key pair consists of a public key and a private key. You can upload your public key on any server, but should keep your private key stored in a protected place preferably with a passphrase.
	* By using SSH keys you can SSH to your server as a user with their SSH key already uploaded to your servers '''authorized_keys''' without a password. If you keep your '''private''' key stored in a secure place, this can immensely help with keeping your server locked down to the outside world.		* By using SSH keys you can SSH to your server as a user with their SSH key already uploaded to your servers '''authorized_keys''' without a password. If you keep your '''private''' key stored in a secure place, this can immensely help with keeping your server locked down to the outside world.
	* Passwords over SSH can easily be ~~brute forced~~ because users tend to make easy to remember passwords, rather than strong passwords. This makes it easier for bots to brute force your users password.		* Passwords over SSH can easily be cracked because users tend to make easy to remember passwords, rather than strong passwords. This makes it easier for bots to brute force your users password.
	For more information please see [[SSH_Keys\| SSH Keys]]		For more information please see [[SSH_Keys\| SSH Keys]]