Guides / Secure a new server

Secure a new Linux server

About 15 minutes. Commands are for Debian and Ubuntu. Do this before you install anything else.

Your IPv4 ports and your whole IPv6 block can be reached from the internet, and bots scan for open services all day. These steps close the easy ways in.

1. Install updates

apt update && apt upgrade -y

2. Change your password

Set a long, unique root password:

passwd

3. Log in with SSH keys

Keys cannot be guessed the way passwords can. Follow Log in with SSH keys, and check that key login works before you turn password login off.

4. Turn on a firewall

Your IPv6 block is not filtered, so a service you start can be public straight away. Inside your server, SSH listens on port 22, even though you connect to it on your first forwarded port. Allow it before you enable the firewall, or you will lock yourself out.

apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw --force enable
ufw status

Then allow each thing you run. For example, an app on port 10002, and a website:

ufw allow 10002/tcp
ufw allow 80/tcp
ufw allow 443/tcp

If you do get locked out, use the Console tab or Repair access in the client area.

5. Turn on automatic security updates

apt install -y unattended-upgrades
systemctl enable --now unattended-upgrades

6. Stop password guessing

If you keep password login on, add fail2ban.

7. Keep your own backups

Plans do not include managed backups. Set up backups with restic before you put anything important on the server.

Each of your services should have the fewest rights it needs. Run apps as their own user, not as root. See Keep an app running with systemd.