Essential security hardening steps for your dedicated server.
Follow these essential security practices to protect your Cd hosting dedicated server.
Edit /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
# Generate SSH key pair (on your local machine)
ssh-keygen -t ed25519 -C "[email protected]"
# Copy public key to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-server-ip
# Generate SSH key pair (on your local machine)
ssh-keygen -t ed25519 -C "[email protected]"
# Copy public key to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-server-ip
# In /etc/ssh/sshd_config
Port 2222
# Restart SSH
systemctl restart sshd
# Update firewall
ufw allow 2222/tcp
ufw delete allow OpenSSH
# In /etc/ssh/sshd_config
Port 2222
# Restart SSH
systemctl restart sshd
# Update firewall
ufw allow 2222/tcp
ufw delete allow OpenSSH
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades
apt install unattended-upgrades -y
dpkg-reconfigure -plow unattended-upgrades
Protect against brute-force attacks:
apt install fail2ban -y
apt install fail2ban -y
Create /etc/fail2ban/jail.local:
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
systemctl enable fail2ban
systemctl start fail2ban
systemctl enable fail2ban
systemctl start fail2ban
apt install libpam-google-authenticator -y
google-authenticator
apt install libpam-google-authenticator -y
google-authenticator
# Create a backup script
#!/bin/bash
DATE=$(date +%Y%m%d)
tar -czf /backups/server-backup-$DATE.tar.gz /var/www /etc /home
find /backups -mtime +30 -delete
# Create a backup script
#!/bin/bash
DATE=$(date +%Y%m%d)
tar -czf /backups/server-backup-$DATE.tar.gz /var/www /etc /home
find /backups -mtime +30 -delete
Add to crontab for daily backups:
0 2 * * * /root/backup.sh
0 2 * * * /root/backup.sh