At a glance Start by updating, limiting SSH, firewalls, backup and controlling running services.
Update system and software
Use security improvements for your system and services. Determine who is responsible for updates and check that the applications are still working after any major change. Remove packages and services you do not use.
Restrict SSH access
Use unique passwords or SSH keys, protect your private key and do not share it with others. Create a separate user with the required permissions for administrative work. Disable root direct login only after checking that alternative access is working — a wrong change can cut you off from the server.
Open only the necessary ports
Use the firewall and describe what every rule is used for. Publicly only provide the services that users use. The administrative port is limited to trusted addresses, if possible. Change the test, while maintaining an active SSH session.
Plan backup and recovery
Store backup outside the server, restrict access to them and check every once in a while if you can restore the data. The information itself that backup exists does not confirm that it is complete.
Monitor logs and accounts
Check authentication logs and services. Remove unused accounts, keys and tokens. When you notice unknown login, change access data from a secure device, secure the backup and check the system before re-exposing the service.
Back up first. Change one thing at a time.
Back up your working files, make a change and check the logs. Changing one thing at a time makes it easier to find the cause of a problem and restore your previous settings.
Back to the knowledge base