How to secure a small Linux server: the basics
Most small servers get compromised through a handful of boring, avoidable gaps. Close these and you're ahead of the great majority of attempts.
The short list
- Log in with keys, not passwords. Turn off password logins for remote access and use an SSH key. This alone stops the endless automated guessing.
- Keep it updated. Turn on automatic security updates. Most break-ins use holes that were fixed months ago.
- Only open what you use. Every service you expose to the internet is a door. Close the ones you don't need, and put the rest behind a firewall.
- Don't run day-to-day as the top-level account. Use a normal account and step up only when you need to.
- Watch for trouble. You can't fix what you can't see — know when someone logs in, when a new service appears, or when a file changes that shouldn't.
Knowing, not guessing
That last point is the hardest to do by hand. Minaki is our own tool for exactly this: a light agent checks a server for break-ins, exposed services, missing updates and risky files, and tells you in plain English what it found and what to do. See minaki.io.