I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html
Changing the default SSH port is a great idea too.
Securing your Linux web server
21–30 of 54 posts
Re: Securing your Linux web server
#22I am so glad nowadays to get websites for my hobby projects going, I just have to do a Github page, and don't have to worry about all that stuff (and don't have to pay, either). Github pages + Static content generators are among the best advancements in the recent years.
Re: Securing your Linux web server
#23I am so glad nowadays to get websites for my hobby projects going, I just have to do a Github page, and don't have to worry about all that stuff (and don't have to pay, either). Github pages + Static content generators are among the best advancements in the recent years.
Back in the day we used to call that "Shared hosting" and it was looked down on by the in-crowd.
Re: Securing your Linux web server
#24One of the things that I'm super happy about is that for basic stuff I don't need to manage servers (static sites / web apps hosted on S3 etc., FaaS for basic Code) and when I do need to have full on servers, I can use something like GKE/EKS/AKE to just deploy containers and not manage the underlying infrastructure.
It's super awesome when working on personal projects! (although in a way I did enjoy doing all that in the first place)
Re: Securing your Linux web server
#25I am so glad nowadays to get websites for my hobby projects going, I just have to do a Github page, and don't have to worry about all that stuff (and don't have to pay, either). Github pages + Static content generators are among the best advancements in the recent years.
Back in the day we used to call that "Shared hosting" and it was looked down on by the in-crowd.
In my experience shared hosting was looked down upon (and still is) not because we were high-and-mighty better-than-thou you-know-nothing toffee-nosed snobs about the entire idea[1], but because of the many (the majority?) of hosts who were absolutely terrible at security (and stability, and performance both generally & through silly levels of over-selling, and everything else, but security is most important).
In this case the hosting is by a company with the technical skills and infrastructure to properly secure and support the service, not some inexperienced kid living with his parents who thinks a simple cPanel installation (that never gets updated for some reason he doesn't notice or can't be bothered to diagnose) is a great almost-zero-effort way to sell hosting to make a bit of extra pocket money over the school/college/other holidays.
Also the lack of control made using certain things impossible, you were usually held back on an old version of mySQL & PHP, and little else to if you wanted to use postgres or python or anything other you were stuck. That is the same here of course: this probably gives you even less control because it is not trying to be shared hosting it is a hosting-platform-as-a-service.
[1] I may actually be a high-and-mighty better-than-thou you-know-nothing toffee-nosed snob, but that is beside the point here!
Re: Securing your Linux web server
#26The old advice to have separate machines for isolation is still valid in spectre and meltdown times.
Re: Securing your Linux web server
#27Earlier quoted context omitted.
I suggest you setup an account on Github and then create a SSH key with a passphrase: https://help.github.com/articles/generating-a-new-ssh-key-an... https://help.github.com/articles/testing-your-ssh-connection... SSH Keys are substantially more secure than passwords.
What does GitHub have to do with it?
Its a free way to test he knows how to use SSH w/o a SSH server to talk to on the other end.
Re: Securing your Linux web server
#28Earlier quoted context omitted.
I'm a generalist project manager. When you say "Disable password login via ssh", what is going to be the login method from this point onwards? Via a personal certificate? Tks
~/.ssh/authorized_keys, which is basically personal certificates.
Or just use actual SSH certificates instead of public keys so you don't need to have authorized_keys file at all.
Re: Securing your Linux web server
#29Earlier quoted context omitted.
The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?
Who is giving the advice to not host your own server? My advice is to do host your own server.
Yep, you should definitely host your own server. And build your own Linux distro. And your own computer. Then weave your own cloth, sew your own clothes, cobble your own shoes. Build a car. Buy some land. Build a house. Move to the country. Raise chickens. Till and sow land. Get off the grid. Abandon the modern world.
It's perfectly possible to drive a car without building one, or to become technically proficient without hosting your own server. If you DIY something, you may learn a lot about it, but it won't make you any better at the thing you actually wanted to do with it.
Re: Securing your Linux web server
#30I have a little checklist I use to cover the basics: https://drewdevault.com/new-server.html
The general advice I've seen is to not host your own server. But I think it would be a great learning experience. If you cover the basics, is your server still extremely vulnerable?
No, but yes.
You can make a very secure system by hosting it yourself. Do you need a very secure system? Or do you just need to know that you need a firewall, and to manage your credentials securely, and to segregate applications' security domains, and do filtering of inputs, and blocking of brute force attacks?
You probably just need to learn about security, and learning to host yourself is not the same thing.