How to Protect a Server: 6 Practical Methods

Technical writer

Servers

02.12.2024

Reading time: 8 min

Any IT infrastructure requires robust protection. While information security is a vast topic, there are basic steps that can safeguard against attacks from amateur hackers and bots. This article outlines six straightforward methods to protect your server effectively.

Tools and Methods of Protection

Securing a server from breaches involves a combination of measures. These can be categorized into the following areas:

Securing communication channels used for system administration and operation.
Implementing multi-layered security for the system.
Restricting access to infrastructure resources.
Monitoring and auditing system activities.
Backing up data.
Timely updates or rollbacks of software.
Antivirus protection for servers.

Below, we detail six practical methods to achieve a robust security level against amateur attackers and bots.

Privilege Restriction

When managing access to resources, follow the principle of least privilege: users and processes should only have the minimal permissions necessary to perform their tasks. This is particularly important for databases and operating systems. This approach not only prevents unauthorized external access but also mitigates risks from internal threats.

Separate Accounts for Administrators: Create individual accounts for each admin. Use non-privileged accounts for operations that don’t require elevated permissions.
Active Directory: In environments using Microsoft Active Directory, regularly audit and configure group policies. Mismanagement of these policies can lead to severe security breaches, especially if exploited by a malicious admin or hacker.
Minimize Root Usage in Unix Systems: Avoid working as the root user. Instead, disable the root account and use the sudo program for tasks requiring elevated permissions.

To customize sudo behavior, modify the /etc/sudoers file using the visudo command. Below are two useful directives for monitoring sudo activity.

By default, sudo logs to syslog. To store logs in a separate file for better clarity, add the following to /etc/sudoers:

Defaults log_host, log_year, logfile="/var/log/sudo.log"

This directive records command logs, along with input and output (stdin, stdout, stderr), into /var/log/sudo-io:

Defaults log_host, log_year, logfile="/var/log/sudo.log"

For a deeper dive into managing the sudoers file, check this guide.

Mandatory Access Control (MAC)

This recommendation focuses on Linux systems and builds upon the principle of access control. Many Linux administrators rely solely on discretionary access control (DAC) mechanisms, which are basic and always active by default. However, several Linux distributions include mandatory access control (MAC) mechanisms, such as AppArmor in Ubuntu and SELinux in RHEL-based systems.

While MAC requires more complex configuration of the OS and services, it allows for granular access control to filesystem objects, significantly enhancing the server's security.

Remote Administration of Operating Systems

When remotely administering an operating system, always use secure protocols:

For Windows, use RDP (Remote Desktop Protocol).
For Linux, use SSH (Secure Shell).

Although these protocols are robust, additional measures can further strengthen security.

For RDP, you can block connections of accounts with blank passwords. You can configure it via Local Security Policy under the setting:

Accounts: Limit local account use of blank passwords to console logon only.

RDP sessions can be protected with the secure TLS transport protocol, which will be discussed later.

By default, SSH user authentication relies on passwords. Switching to SSH key-based authentication provides stronger protection, as a long key is far more difficult to brute-force than a password. Additionally, key-based authentication eliminates the need to enter a password during login since the key is stored on the server.

Setting up keys requires only a few simple steps:

Generate a key pair on your local machine:

ssh-keygen -t rsa

Copy the public key to the remote server:

ssh-copy-id username@remote_address

If key-based authentication is not an option, consider implementing Fail2ban. This tool monitors failed login attempts and blocks the IP addresses of attackers after a specified number of failed attempts.

Additionally, changing default ports can help reduce the likelihood of automated attacks:

Default SSH port 22/tcp → Choose a non-standard port.
Default RDP port 3389/tcp → Use a custom port.

Firewall Configuration

A robust security system is layered. Relying solely on access control mechanisms is insufficient; it is more logical to manage network connections before they reach your services. This is where firewalls come in.

A firewall provides network-level access control to segments of the infrastructure. The firewall decides which traffic to permit through the perimeter based on a specific set of allow rules. Any traffic that does not match these rules is blocked. In Linux, the firewall is integrated into the kernel (via netfilter), and you can manage using a frontend tool such as nftables, iptables, ufw, or firewalld.

The first step in configuring a firewall is to close unused ports and keep only those that are intended for external access. For instance, a web server typically requires ports 80 (HTTP) and 443 (HTTPS) to remain open. While an open port itself is not inherently dangerous (the risk lies in the program behind the port), it is still better to eliminate unnecessary exposure.

In addition to securing the external perimeter, firewalls can segment infrastructure and control traffic between these segments. If you have public-facing services, consider isolating them from internal resources by using a DMZ (Demilitarized Zone). Additionally, it’s worth exploring Intrusion Detection and Prevention Systems (IDS/IPS). These solutions work on the opposite principle: they block security threats while allowing all other traffic through.

Hostman offers a cloud firewall that provides cutting-edge defense for your server.

Virtual Private Networks (VPNs)

Up until now, we have focused on protecting a single server. Let’s now consider securing multiple servers. The primary purpose of a Virtual Private Network (VPN) is to provide secure connectivity between organizational branches. Essentially, a VPN creates a logical network over an existing network (e.g., the Internet). Its security is ensured through cryptographic methods, so the protection of connections does not depend on the underlying network's security.

There are many protocols available for VPNs, and the choice depends on the size of the organization, network architecture, and required security level.

PPTP (Point-to-Point Tunneling Protocol) is a simple option for a small business or home network, as it is widely supported on routers and mobile devices. However, its encryption methods are outdated.
For high-security needs and site-to-site connections, protocols like IPsec are suitable.
For site-to-host connections, options like WireGuard are more appropriate. WireGuard and similar protocols provide advanced security but require more intricate configuration compared to PPTP.

TLS and Public Key Infrastructure (PKI)

Many application-layer protocols, such as HTTP, FTP, and SMTP, were developed in an era when networks were limited to academic institutions and military organizations long before the invention of the web. These protocols transmit data in plaintext. To ensure the security of a website, web control panels, internal services, or email, you should use TLS.

TLS (Transport Layer Security) is a protocol designed to secure data transmission over an untrusted network. While the term SSL (e.g., SSL certificates, OpenSSL package) is often mentioned alongside TLS, it’s important to note that the modern versions of the protocol are TLS 1.2 and TLS 1.3. Earlier versions of TLS and its predecessor, SSL, are now considered obsolete.

TLS provides privacy, data integrity, and resource authentication. Authentication is achieved through digital signatures and the Public Key Infrastructure (PKI). PKI functions as follows: the server's authenticity is verified using an SSL certificate, which is signed by a Certificate Authority (CA). The CA’s certificate is, in turn, signed by a higher-level CA, continuing up the chain. The root CA certificates are self-signed, meaning their trust is implicitly assumed.

TLS can also be used with Virtual Private Networks (VPNs), such as setting up client authentication using SSL certificates or a TLS handshake. In this case, it would be necessary to organize your own PKI within the local network, including a CA server, as well as the keys and certificates for network nodes.

The Dangers of Attackers

The level of threat depends on the type of attack. Cyberattacks can be broadly categorized into two main types.

Breaching the Security Perimeter

This type of attack involves gaining unauthorized access to the account of an authenticated user of a service or system, such as a database. Breaches of privileged accounts pose significant risks because attackers gain the ability to view sensitive information and modify system parameters. The most critical type of breach involves gaining unauthorized access to the superuser account of the operating system, potentially compromising a significant portion of the infrastructure.

Disabling Systems

This category of attacks aims to disrupt system operations rather than steal data, but it is no less dangerous. The most prominent example is a DoS (Denial of Service) or DDoS (Distributed Denial of Service) attack. These attacks overload the server with a flood of requests, causing it to fail and become unresponsive to legitimate users. In some cases, a DoS attack serves as a precursor to other forms of cyberattacks.

The results of cyberattacks often include data breaches, financial losses, and reputational damage. For this reason, even the most basic level of security should be implemented when establishing an IT infrastructure.

Servers

02.12.2024

Reading time: 8 min

Similar

Ubuntu

How to Protect a Server: 6 Practical Methods

Tools and Methods of Protection

Privilege Restriction

Mandatory Access Control (MAC)

Remote Administration of Operating Systems

Firewall Configuration

Virtual Private Networks (VPNs)

TLS and Public Key Infrastructure (PKI)

The Dangers of Attackers

Similar

How to Install VNC on Ubuntu

How to Correct Server Time

How to Set Up Network Storage with FreeNAS

Do you have questions, comments, or concerns?

Do you have questions,
comments, or concerns?