Do these before anything else.
THE ORDER
- Log in and change the root password to something long and unique.
- Create a non-root user with sudo privileges.
- Set up SSH key authentication for that user.
- Disable password authentication for SSH.
- Disable direct root login over SSH.
- Change the SSH port if you choose to.
- Configure the firewall, permitting only what you need.
- Apply all available system updates.
- Set the hostname and timezone.
- Configure automatic security updates, or a reminder to apply them.
- Set up backups.
- Set up basic monitoring.
WHY THIS ORDER
Automated attacks find new servers within minutes of them appearing online. A server with password authentication enabled and a weak root password is compromised quickly, sometimes before you have finished setting it up.
DO NOT PUT ANYTHING LIVE FIRST
The temptation is to install your application and secure the server later. Later frequently does not happen, and a compromise in the meantime costs far more than the hour.
IF YOU BOUGHT MANAGED
Confirm with us which of these we have done.
