3 ms·
First thing I always do on any new VPS is to sort out SSH (disable root login, disable password login), set up fail2ban, install and configure ufw... and if I n
by ljm 6y ago
First thing I always do on any new VPS is to sort out SSH (disable root login, disable password login), set up fail2ban, install and configure ufw... and if I need to set up something like redis or similar, make sure it only listens to internal connections and also that it is decently auth'd. For deployment and other things I make users that can only write to certain directories; no sudo. It's nothing new or special but it gets lost in distributed systems.
It's a lot more work when doing it in the cloud and spinning up these things from docker containers in K8S...but you're entirely to blame if you don't know what you're deploying and don't understand any of the potential threats.
- mkl 6y agoDo you know of any good resources for learning this stuff? I'm interested in being able to do this sort of thing on a small scale, but there seems to be an awful lot that I don't know I don't know.
- thrownblown 6y agohttps://github.com/konstruktoid/hardening https://github.com/konstruktoid/hardening What the parent post said is pretty much it in a nutshell, but I use that GitHub for basic Ubuntu server setup.
- KingOfCoders 6y agoWhen is didn't know better, I was always bitten by Docker circumventinging ufw.