Attackers are always on the lookout for server vulnerabilities. It is therefore your responsibility to make sure that your data is safe and secure.
Minimize the risks and be sure that your data is safe on secure servers by putting into practice our security advice and our best practices.
Server connectivity
1. Establish and use a secure connection
When connecting to a remote server, it is essential to establish a secure communication channel.
Using the SSH protocol ( Secure Shell ) is the best way to establish a protected connection. Unlike Telnet, which was used previously, SSH access encrypts all the data transmitted in the exchange.
You must install the SSH daemon and have an SSH client with which you issue commands and manage the servers in order to obtain remote access using the SSH protocol.
By default, SSH uses port 22 . Everyone, including attackers, knows this. Most people do not configure this seemingly insignificant detail. However, changing the port number is a simple way to reduce the chances of attackers attacking your server. Therefore, the best practice for SSH is to use port numbers between 1024 and 32,767.
2. Use SSH key authentication
Instead of a password, you can authenticate to an SSH server using an SSH key pair, a better alternative to traditional logins. Keys contain far more bits than a password and are not easily cracked by most modern computers. The popular 2048-bit RSA encryption is equivalent to a 617-digit password.
The key pair consists of a public key and a private key.
The public key has several copies, one of which stays on the server, while others are shared with the users. Anyone who has the public key has the power to encrypt data, while only the user who has the matching private key can read that data. The private key is not shared with anyone and must be kept secure. When a connection is established, the server asks for proof that the user has the private key, before granting privileged access.
3. Secure file transfer protocol
To transfer files to and from a server without the risk of attackers compromising or stealing data, it is essential to use the FTPS protocol (File Transfer Protocol Secure) . It encrypts the data files and your authentication information.
FTPS uses both a command channel and a data channel, and the user can encrypt both. Keep in mind that it only protects the files during the transfer. As soon as they reach the server, the data is no longer encrypted. For this reason, encrypting the files before sending them adds another layer of security.
4. Secure Sockets Layer certificates
Secure your web administration areas and your forms with Secure Socket Layer (SSL) which protects the information transmitted between two systems over the Internet. SSL can be used both in server-client and in server-server communication.
The program scrambles the data so that sensitive information (such as names, identifiers, credit card numbers and other personal information) is not stolen in transit. Websites that have the SSL certificate have HTTPS in the URL, indicating that they are secure.
Not only does the certificate encrypt the data, it is also used for user authentication. Therefore, by managing the certificates for your servers, this helps establish the authority of the users. Administrators can configure the servers to communicate with a centralized authority and with any other certificate that the authority signs.
5. Use private networks and VPNs
Another way to ensure secure communication is to use private and virtual networks (VPNs) and software such as OpenVPN. Unlike open networks, which are accessible to the outside world and therefore vulnerable to attacks from malicious users, private and virtual private networks limit access to certain users.
Private networks use a private IP address to establish isolated communication channels between the servers of the same range. This allows several servers under the same account to exchange information and data without being exposed to a public space.
When you want to connect to a remote server as if you were doing so locally over a private network, use a VPN. It allows a fully secure and private connection and can encompass several remote servers. For servers to communicate under the same VPN, they must share security and configuration data.
Server user management
6. Monitor login attempts
Using intrusion prevention software to monitor login attempts is one way to protect your server against brute force attacks. These automated attacks use a trial and error method, trying every possible combination of letters and numbers to gain access to the system.
Intrusion prevention software supervises all the log files and detects suspicious login attempts. If the number of attempts exceeds the defined norm, the intrusion prevention software blocks the IP address for a certain period or even indefinitely.
7. Manage users
Every server has a root user who can run any command. Because of the power it has, root can be very dangerous for your server if it falls into the wrong hands. It is common practice to disable root login over SSH completely.
Since the root user has the most power, attackers focus their attention on trying to crack the password of that specific user. If you decide to disable this user completely, you will put attackers at a significant disadvantage and save your server from potential threats.
To make sure that third parties do not misuse root privileges, you can create a limited user account. This account does not have the same rights as root but is still able to carry out administrative tasks using the sudo commands.
Therefore, you can administer most tasks as a limited user account and use the root account only when it is necessary.
Server password security
8. Establish the password security requirements
The first thing to do is to define the password requirements and rules that must be followed by all the members of the server.
Do not allow empty or default passwords. Enforce a minimum password length and complexity. Have a lockout policy. Do not store passwords using reversible encryption. Force session expiration on inactivity and enable two-factor authentication.
9. Define the password expiration policy
Defining an expiration date for a password is another common practice when defining the requirements for users. Depending on the level of security required, a password can last a few weeks or a few months.
10. Use passphrases for server passwords
There are several reasons why using a passphrase rather than a password can help improve server security. The main difference between the two is that a passphrase is longer and contains spaces between the words. Therefore, it is often a sentence, but it does not have to be a sentence.
For example, a password passphrase can be: J'm! la sécuQdc'estb1fait.
The example given is longer than a usual password and contains uppercase and lowercase letters, numbers and unique characters.
Moreover, it is much easier to remember a passphrase than a string of random letters. Finally, since it consists here of 26 characters, it is harder to crack.
11. Password practices to avoid
If you want to maintain a secure server, you must avoid certain things when it comes to passwords. First of all, pay attention to where you store the passwords. Do not write them on pieces of paper and do not hide them in the office.
It is generally advisable not to use personal information such as your birthday, your home town, the names of pets and other elements that can link the user to the password. These are extremely easy to guess, in particular by people who know you personally.
Passwords that contain only simple dictionary words are also easy to crack, in particular through dictionary (brute force) attacks. Aware of the same risk, try to avoid repeating sequences of characters in the same password.
Finally, do not use the same password for several accounts. By reusing passwords, you expose yourself to significant risks. If an attacker manages to access a single account, all the other accounts with the same password may be at risk. Try to use a different password for each separate account and keep track of them using a password manager such as our solution AwPasswords or the very well-known KeePass.
Other good practices for securing a server
12. Update and upgrade regularly
Updating regularly on a server is a crucial step in protecting it from attackers. Outdated software has already been explored for its weak points, leaving attackers the opportunity to take advantage of them and damage your system. If you keep everything up to date, you make sure that it is ready to protect itself as the first line of defense.
Automatic updates are one way to guarantee that no update is forgotten. However, allowing the system to make such changes on its own can be risky. Before updating your production environment, it is recommended to examine how the update performs in a test environment.
Make sure you regularly update the server control panel. You must also regularly update content management systems, if you use one, as well as all the plugins it may have. Each new version includes security fixes to resolve known security problems.
13. Remove or disable all unnecessary services
Increase server security by reducing the so-called attack vector.
This cybersecurity term refers to installing and maintaining only the minimum requirements needed to keep your services running. Simply enable the network ports used by the operating system and the installed components. The less you have on the system, the better.
A Windows OS server must have only the required operating system components. A Linux operating system server must have a minimal installation with only the genuinely necessary packages installed.
Since most Linux distributions listen for incoming connections on the Internet, you must configure a firewall to allow only specific ports and to refuse all other unnecessary communications.
Check the dependencies before installing software on your system to make sure that you are not adding anything you do not need. Also check which dependencies have been started automatically on your system and whether you want them.
14. Hide the server information
Try to provide as little information as possible about the underlying infrastructure. The less that is known about the server, the better.
It is also wise to hide the version numbers of any software you have installed on the server. Often, they reveal, by default, the exact release date which can help attackers look for weaknesses. It is generally simple to remove this information by deleting it from the HTTP header of its welcome banner.
15. Use intrusion detection systems
To detect any unauthorized activity, use an intrusion detection system (IDS) , such as Sophos, which monitors the processes running on your server. You can configure it to check daily operations, run periodic automated scans or decide to run the IDS manually.
16. File auditing
File auditing is another good way to discover unwanted changes on your system.
It keeps a record of all the characteristics of your system when it is in a good "healthy" state and compares it with the current state. By comparing the two versions of the same system side by side, you can detect any inconsistencies and trace their origin.
17. Service auditing
Service auditing explores the services running on the server, their protocols and the ports through which they communicate. Being aware of these specifics makes it possible to manage the potential attack surfaces in the system.
18. Configure and manage a firewall
Secure your server by controlling and restricting access to your system.
Using CSF (ConfigServer and Firewall) is essential to strengthen the security of your server. It allows only specific vital connections, locking access to other services.
Configure a firewall during the initial configuration of the server or when you change the services offered by the server. By default, a typical server runs different services, in particular public, private and internal services.
- Public services are generally managed by web servers that must allow access to a website. Everyone can access these services, often anonymously, over the Internet.
- Private services are used to handle a database control panel, for example. In this case, a certain number of selected people need to access the same point. They have authorized accounts with special privileges inside the server.
- Internal services are those that should never be exposed to the Internet or to the outside world. They are only accessible from the server and only accept local connections.
The role of the firewall is to allow, restrict and filter access according to the service for which the user is authorized. Configure the firewall to restrict all services except those that are mandatory for your server.
19. Back up your server
Although the steps mentioned previously are designed to protect the data on your server, it is crucial to have a backup of the system in case of a problem.
Store the encrypted backups of your critical data off site or use a cloud solution.
Whether you have automated backup jobs or you run them manually, make sure you turn this precautionary measure into a routine. You must also test the backups, by carrying out full backup tests. This should include "consistency checks" in which the administrators or even the end users verify that the data recovery is consistent.
20. Create multi-server environments
Isolation is one of the best types of server protection you can have.
Complete separation would require having dedicated bare-metal servers that do not share any component with other servers. Although this is the easiest to manage and offers the most security, it is also the most expensive.
Having isolated runtime environments in a data centre allows the so-called separation of duties (SoD) and the configuration of the server according to the functions the server fulfills.
Separating database servers and web application servers is a standard security practice. Separate runtime environments are particularly beneficial for larger-scale companies that cannot afford any security breach.
Independent database servers secure sensitive information and system files from attackers who manage to access administrative accounts. In addition, isolation allows system administrators to configure the security of the web application separately and to minimize the attack surface by setting up web application firewalls.
21. Create isolated virtual environments
If you cannot afford or do not need complete isolation with dedicated server components , you can also choose to isolate the runtime environments.
This helps you resolve the security problems that may arise, thus guaranteeing that the other data is not compromised. You can choose between containers or VM virtualization, which are much easier to configure.
Another option for virtualized environments in a UNIX operating system is to create chroot jails. Chroot separates a process from the root directory of the central operating system and allows it to access only the files of its directory tree. However, this is not complete isolation and should only be practiced together with other security measures.
Conclusion: securing your server
After reading this article and following the security recommendations, you should be more confident in the security of your server.
Many security measures must be put in place during the initial configuration of the server, while others must be part of ongoing or periodic maintenance. If the monitoring of your server is not automated, make sure you design and follow scheduled security checks.
#security
Now, to work!