Your cloud server starts with a good foundation: an up-to-date system, SSH login only with keys and a firewall in front of the system. What happens after that is up to you. We recommend these points:
1. Install updates regularly
Keep the operating system and applications up to date. For Debian and Ubuntu the package unattended-upgrades provides automatic security updates, for AlmaLinux, Rocky Linux and CentOS Stream dnf-automatic. Create a snapshot before larger updates.
# Debian / Ubuntu
apt update && apt full-upgrade
# AlmaLinux, Rocky Linux, CentOS Stream
dnf upgrade2. Secure SSH
- Log in only with an SSH key and protect the private key with a passphrase.
- Work day to day with your own user and sudo instead of directly as root.
- Keep password login via SSH switched off.
- Remove keys you no longer need from
~/.ssh/authorized_keys.
3. Use the firewall
Only open the ports you really need and restrict administrative access such as SSH to known source addresses where possible. How to do this is shown in Cloud server firewall.
4. Limit login attempts
Tools such as Fail2ban or CrowdSec detect repeated failed logins and temporarily block the senders. This relieves your logs and makes attacks on weak access points of your applications harder.
5. Only run the services you need
Every service is a potential attack surface. Check with ss -tulpen which services listen on which ports and switch off what you do not need. Databases should only be reachable locally or from specific addresses.
6. Back up data
Book the external backup and additionally keep a copy of important data of your own elsewhere. Test occasionally whether restoring works - for example by downloading individual files from a backup.
7. Protect web applications additionally
If you run websites or shops, ShieldCache can be placed in front of your server: a web application firewall with cache that intercepts attacks on your application before they reach the server. More in the ShieldCache knowledge base.
8. Watch for anomalies
Regularly take a look at the statistics and the firewall log. Unusually high CPU or network load may indicate a problem.
Abuse and security incidents
If you find that your server has been compromised, isolate it from the network via the firewall or shut it down, secure logs and data and reinstall it. Our support is happy to help.