Securing your server

The first ten minutes, and the handful of things that actually matter.

What we already did

Your server ships with a firewall that denies incoming traffic except the ports your app needs, automatic security updates switched on, and fail2ban, which bans addresses that repeatedly guess passwords.

That is a reasonable baseline. The steps below are what turns it into a server you can stop thinking about.

Change your password, then stop using one

Then set up a key as described in Connecting with SSH, confirm it works from a second terminal, and turn passwords off entirely by editing /etc/ssh/sshd_config to set PasswordAuthentication no, followed by systemctl restart ssh.

Once key-only login is on, password-guessing attacks stop being something you have to care about at all.

$ passwd

Keep it patched

Unattended upgrades handle security patches, but not everything. Once a month is plenty for the rest:

$ apt update && apt upgrade -y

Apps update separately

Your app runs in Docker, and updating Ubuntu does not update it. Each app's documentation page has its own update command. Take a snapshot first — an app upgrade that goes wrong is the exact situation snapshots exist for.

Keep reading

Getting startedWhat you get when you order, and what to do in the first ten minutes. Connecting with SSHHow to reach the command line on your server, and why the port is not 22. Snapshots and backupsTwo different safety nets. Most people need both. Reading your usage metersWhat CPU, memory and disk are telling you — and when a high number is fine. Addresses and portsWhy some apps give you a web link and others give you a host and a number. Sending email from your appWhy your app cannot send email until you give it a mail provider, and how to set one up.