DEV Community

How to Protect Your Server From Hackers

Vitaliy Kolesov on March 27, 2019

This post was originally posted in my personal blog. It is not a hard deal to make your server secure, but when a lot of routines comes, It is pos...

Read full post

Padde • Mar 28 '19

While fail2ban is very useful you still get a lot of automated authentication attempts. I additionally added port knocking using the knock daemon on the Server: so in regular state even the ssh port is blocked by the firewall. to temporarily unlock the ssh port you have to knock on a few ports in a configurable order. only then the ssh port is opened for a few seconds foryou to connect to. e.g. knock youserver.com 18754 26557 28864 && ssh user@yourserver.com to login

this completely took away the failed login attempts in my logs.

Vitaliy Kolesov • Mar 28 '19

Thank you for knock utility. Never used it before.

Glenn Carremans • Mar 27 '19

Great post! This is also my default workflow when I setup a new VPS.

Just a couple of tips:

Just like SSH has an alternative syntax you can do the same for port 80 and 443.
ufw allow http & ufw allow https

You can also run the command: ufw app list
This will show a list of available applications that you can add to your UFW firewall so that if the port config has changed for example this will also be updated in your UFW.
My UFW rules:

To                         Action      From
--                         ------      ----
Nginx Full                 ALLOW       Anywhere
OpenSSH                    ALLOW       Anywhere
Nginx Full (v6)            ALLOW       Anywhere (v6)
OpenSSH (v6)               ALLOW       Anywhere (v6)

If you want your server to accept IPv6 you will need to enable this in your UFW config.

sudo nano /etc/default/ufw

And then change this: IPV6=yes
UFW reboot required after this change of course.

For fail2ban I have 3 jails enabled: sshd, sshd-ddos and nginx-botsearch
Current status for my sshd jail:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed: 28259
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned: 78
   `- Banned IP list:

Vitaliy Kolesov • Mar 27 '19 • Edited

Thanks to you, I pay attention to sshd-ddos!

In front of the nginx on my server I have traefik inside the docker container. I will try to research how to make them work together.

Gergely Polonkai • Apr 4 '19

It feels really strange that neither the article nor anyone in the comments mention one of the most important thing:

Keep your software up to date

You can devise a firewall as hard to open as the most sophisticated safe, but if the back of the safe is missing, you did nothing. Security vulnerabilities happen, not just in the applications you use, but even in the operating system. Keep everything up to date, and you are one step closer to being protected.

Vitaliy Kolesov • Apr 4 '19 • Edited

Completely agree with your advice. I forgot to mention it in the article, I changed the post with your advice. Thank you!

Alice-sos • Apr 15 '19

Hi,

I hope to get your consent to translate and shared with Chinese developers, I will indicate the source and author.

Vitaliy Kolesov • Apr 15 '19

Surely, you can do it!

Alice-sos • Apr 28 '19

Chinese link：nextfe.com/protect-server-from-hac... （中文）

Alice-sos • Apr 15 '19

Thanks!

LuisPa • Mar 28 '19

Great post!

Thanks for sharing.

southcarolina803 • Mar 28 '19

Thank you !

Juanjo Salvador • Mar 28 '19

Great post! Really needed!

Vitaliy Kolesov • Apr 4 '19 • Edited

I set up a weak root password (it was the same as I used to have on my local PC) and forgot to close password access to the server in /etc/ssh/sshd_config.