Recommended Security Measures to Protect Your Servers

While these are all fairly obvious if you’ve ever worked in industry, this is a great introduction to those who have not. Well written!

It would be really nice if there were an [end to end configuration] example with CoreOS and Docker and all the security already setup. Hope @digitalocean will produce one :)

Thanks for this, interesting read, will adopt some of these.

In the section, “File Auditing and Intrusion Detection Systems”, you say that IDS is difficult to admin. I am using a backup tool called the Barebones Encrypted File Storage System as a lightweight IDS. It creates incremental backups and sends me an e-mail with the list of changed files. It doesn’t stop changes from happening but simply reports them. If I need to roll back for any reason, I’ve got 31 days worth of incrementals to work with. I’ve used it on a few occasions that had nothing to do with system intrusion and more to do with administrator stupidity. Over the years of administrating Linux boxes, I’ve learned the hard way that backing up everything under /etc on a regular basis is extremely important. Getting extra mileage as an IDS is icing on the cake.

Intrusion Detection is not hard. Install OSSEC. While there are some good changes one should make to the configuration files for maximum effect, it works very well straight out of the box.

http://www.ossec.net/

portsentry available in debian repos is worth mentioning too. works similar to fail2ban almost out of the box.

root@droplet ~> grep portsentry /var/log/syslog* | grep Host | uniq | sort | wc -l 109

This comment has been deleted

This comment has been deleted

This comment has been deleted

This comment has been deleted