Defend Your Linux VPS from Hacks: 20 Proven Steps for Enhanced Security

Unquestionably, Linux Virtual Private Servers (VPS) offer numerous benefits. Undoubtedly, in comparison to alternative operating systems such as Windows, Linux VPS boasts superior security due to its robust security model (LSM). Nevertheless, Linux VPS servers are not flawless, nor entirely impervious to threats. Hence, within this article, we shall delve into a compilation of 20 effective measures to fortify your VPS, effectively safeguarding it against potential hacking attempts. Linux possesses an inherently robust security system, surpassing that of most rival platforms. However, it still exhibits certain vulnerabilities.

At Crypadvise, we strongly emphasize the significance of an impregnable server, leaving absolutely no space for concessions. In order to shield your Linux VPS server with maximum efficiency and prevent potential intruders from infiltrating your website and obtaining confidential data, we have meticulously assembled a collection of expert recommendations.

While comprehensive security testing remains the ultimate defense, we offer a selection of rapid measures to bolster your server's protection promptly. These strategies can be implemented with minimal time and effort, though some level of administrative expertise is beneficial.

Without further ado, let's delve into 20 foolproof methods to fortify your VPS and ensure its security.

1. Root Login Disabling

Looking for a secure Virtual Private Server (VPS)? One crucial step is to refrain from logging in as the root user.

Every Linux VPS comes with the default "root" username, making it a prime target for hackers attempting brute force attacks to breach the password and gain unauthorized access. Enhancing your security involves disabling logins via the "root" username, adding an extra layer of protection by preventing hackers from easily guessing your login credentials.

Instead, opt for an alternative username and rely on the "sudo" command to execute commands at the root level. "Sudo" grants authorized users special access rights to perform administrative tasks, eliminating the need for direct root access.

Before you disable the "root" account, ensure you create a non-root user with the appropriate levels of authorization.

When you are prepared to proceed, open the file "/etc/ssh/sshd_config" using either nano or vi text editors and locate the "PermitRootLogin" parameter, which is set to "yes" by default. Modify it to "no" and save the changes to bolster your VPS security.

2. Modifying the SSH Port for Maximum Security

Ensuring SSH remains elusive makes it challenging for hackers to breach. By altering the SSH port number, you deter malicious scripts from directly targeting the default port (22).

To execute this process, navigate to /etc/ssh/sshd_config and modify the relevant configuration.

It is essential to verify that the selected port number is not already in use by other services to avoid potential conflicts.

3. The Significance of Keeping Software Updated

Updating your server's software is a straightforward process. To achieve this, utilize the rpm/yum package manager (for CentOS/RHEL) or apt-get (for Ubuntu/Debian) to upgrade installed software, modules, and components to their latest versions.

For added convenience, configure the operating system to send email notifications about yum package updates, enabling easy tracking of changes. Moreover, automating the task through a cronjob ensures the timely application of all available security updates.

For users employing panels like Plesk or cPanel, updating them is essential. Most panels can be set to update automatically, with cPanel relying on EasyApache for most package updates.

Prioritize the swift implementation of security patches to minimize susceptibility to potential malicious attacks. Delaying updates increases the risk of security breaches.

4. Why You Should Disable Unused Ports

Exposed network ports and inactive network services present vulnerable points that malicious actors can exploit. It is essential to shield yourself from potential exploitation.

Employ the "netstat" utility to view a comprehensive list of presently active network ports and their corresponding services.

Contemplate configuring "iptables" to shut down all accessible ports or utilize the "chkconfig" command to deactivate undesired services. Additionally, if you utilize a firewall such as CSF, you can streamline the process by automating iptables rules.

5. The Advantages of Eliminating Unwanted Modules and Packages

Chances are you won't require every pre-installed package and service that came with your Linux distribution. Each service you eliminate reduces potential vulnerabilities, so ensure you only have essential services running.

Moreover, refrain from installing superfluous software, packages, and services to mitigate potential risks. A positive outcome of this practice is that it optimizes your server's performance as well.

6. Disabling IPv6 for Improved Performance

IPv6 boasts numerous benefits compared to IPv4, but the reality is that its adoption remains low, with only a few individuals utilizing it. However, hackers are capitalizing on this situation, frequently employing IPv6 to transmit harmful traffic and exploit vulnerabilities. Leaving the protocol enabled exposes you to potential security breaches. To counter this issue effectively, access the file /etc/sysconfig/network and modify the settings to reflect NETWORKING_IPV6=no and IPV6INIT=no.

7. Utilizing GnuPG Encryption for Added Security

Cyber attackers frequently focus on intercepting data during its journey across networks. Hence, it becomes imperative to safeguard your server's transmissions with encryption, employing passwords, keys, and certificates. GnuPG, a well-known application, serves as a key-based authentication system designed for communication encryption. This process utilizes a "public key" that remains decryptable solely by the designated recipient possessing the exclusive "private key."

8. Why a Strong Password Policy is Essential

Inadequate passwords have always posed a substantial security risk, and this vulnerability persists. To bolster security, refrain from allowing user accounts to possess empty password fields or use easily guessable passwords like "12345678," "password," "qwerty1234," or "111111."

Enhancing security involves enforcing password complexity rules, requiring a combination of upper and lower-case characters, numbers, and symbols, while avoiding dictionary words. Additionally, consider implementing password aging to prompt users to change their passwords periodically, and contemplate limiting the reuse of previous passwords.

To further protect your system from brute force attacks, employ the "faillog" command to set a login failure limit and automatically lock user accounts after repeated unsuccessful attempts.

9. The Significance of Firewall Configuration

In essence, to ensure optimal security for your Virtual Private Server (VPS), a firewall is indispensable.

Fortunately, numerous options are available to suit your requirements. NetFilter, an integrated firewall within the Linux kernel, allows customization to block undesirable traffic effectively. By combining NetFilter with iptables, you can combat distributed denial of service (DDoS) attacks.

TCPWrapper stands as another valuable tool—a host-based access control list (ACL) system designed to regulate network access for various programs. Its features include host name verification, standardized logging, and spoofing protection, all contributing to bolstering your overall security.

Additionally, CSF and APF are prominent firewalls, offering convenience through plugins compatible with well-known panels like cPanel and Plesk.

10. How Disk Partitioning Improves Performance

To heighten security, consider partitioning your disk to segregate operating system files from user files, tmp files, and third-party applications. Another precautionary measure involves disabling SUID/SGID access (nosuid) and prohibiting binary execution (noexec) on the operating system partition.

11. Why Making /boot Read-Only Matters

Linux servers store all kernel-specific files within the "/boot" directory.

By default, this directory is set to "read-write" access. However, to ensure the integrity of critical boot files, vital for the seamless operation of your server, it is advisable to switch the access level to "read-only."

You can achieve this by editing the "/etc/fstab" file and adding LABEL=/boot /boot ext2 defaults, ro 1 2 at the end. Should you need to modify the kernel in the future, you can easily switch back to "read-write" mode. After making your desired changes, revert to "read-only" mode once you have completed the process.

12. How SFTP Outperforms Traditional FTP

The conventional File Transfer Protocol (FTP) has become outdated and poses security risks, even with "FTP over TLS" (FTPS) encrypted connections.

Both FTP and FTPS remain susceptible to packet sniffing, where external programs intercept and log network traffic. FTP is completely exposed, and while FTPS encrypts credentials, file transfers are still "in the clear."

On the other hand, Secure FTP (SFTP), also known as "FTP over SSH," provides robust encryption for all data, including credentials and transferred files. At Crypadvise, we exclusively endorse SFTP due to its enhanced security features.

13. The Role of a Firewall in Safeguarding Your Network

The guardian of your server, the firewall, determines whether to permit or block access, serving as your primary shield against unauthorized intrusions.

During the setup and securing of a VPS or bare metal server, prioritize the installation and configuration of a firewall as one of your initial tasks. For additional protection, seeking assistance from companies like Castra, specializing in threat security, is advisable.

At Crypadvise, our managed hosting plans incorporate security hardening right from the deployment of your VPS or dedicated bare-metal server.

14. Install Antimalware and Antivirus for Enhanced Safety

A firewall plays a critical role in safeguarding your system by blocking access to known sources of malicious traffic, serving as your initial line of protection. However, even the most robust firewall cannot guarantee complete security, leaving room for harmful software to slip through. To bolster your defense, additional protective measures are necessary.

Sadly, many inexperienced server administrators neglect the installation of anti-malware software, a costly mistake. Their reluctance to invest in security software often stems from budget constraints. Nonetheless, opting for paid solutions generally proves to be more effective. The revenue generated from these solutions enables the hiring of skilled programmers and researchers, ensuring the software's ongoing relevance and potency.

Yet, if budgetary constraints are a concern, exploring free alternatives can still be a viable option. Notably, ClamAV and Maldet are two open-source applications capable of scanning your server and detecting potential threats. Consequently, Crypadvise incorporates both of these applications as part of the VPS security hardening process for managed hosting clients, prioritizing their safety and peace of mind.

15. Enable CMS Auto-Updates Today

Persistent cybercriminals are constantly on the hunt for vulnerabilities in your content management system (CMS), making it crucial to secure your website. The web is flooded with widely-used CMS providers like Wix, Squarespace, Shopify, and Blogger, which holds a substantial 20% share of websites.

To maintain robust security, CMS developers frequently release updates encompassing security fixes and exciting new features. For added convenience, many CMS platforms offer automatic updates, ensuring swift application of the latest fixes upon release. While other CMS platforms embraced auto-updates earlier, WordPress joined the bandwagon a bit later, potentially disabling auto-updates for older websites. Always verify your settings and enable auto-updates when available to stay up-to-date with security measures.

Remember, the responsibility for your website's content lies with you, not your hosting provider. It's vital to keep your website content regularly updated and consider taking regular backups as an additional precautionary measure.

16. Activating cPHulk for Advanced Protection

Apart from providing a firewall, cPanel also incorporates a robust "cPHulk" feature to defend against brute force attacks.

While firewalls offer significant protection, they are not immune to false positives, allowing potentially harmful traffic to slip through. Additional adjustments to the firewall settings might be necessary to enhance security.

In the interim, cPHulk serves as a supplementary firewall, effectively thwarting brute-force attacks that involve repeated attempts to guess the password used on the server.

Typically, cPHulk takes precedence and blocks login attempts before the firewall intervenes, leading to the IP address being banned. To enable this feature, navigate to the WHM Security Center and opt for cPHulk Brute Force Protection. This step is part of the comprehensive security hardening procedure implemented on Crypadvise's managed VPS and dedicated servers.

17. Prohibit Unauthorized Uploads

By default, cPanel and Plesk both have anonymous FTP uploads disabled. However, some other configurations may come with it enabled from the start.

Permitting anonymous users to upload files through FTP poses a significant security threat, as it grants unrestricted access to your web server. This practice is strongly discouraged and comparable to handing your keys to a burglar.

To deactivate anonymous uploads, modify the FTP configuration settings on your server.

18. Rootkit Scanner Setup

Among the most perilous forms of malicious software is the rootkit.

Operating at the core of the operating system (OS), beneath typical security applications, this insidious malware can grant unauthorized access to a server, evading detection. Fortunately, an open-source tool named "chrootkit" offers a solution to determine if your server has been infected. However, removing rootkits is often a challenging task, and the most effective resolution frequently involves reinstalling the OS.

19. The Power of Consistent Data Backups

Many individuals overlook the importance of maintaining regular backups - a decision they later regret when faced with data loss due to unforeseen circumstances. Despite your vigilance and the apparent security of your server, the possibility of encountering issues can never be completely ruled out.

Avoid unnecessary risks by neglecting backups, and refrain from relying solely on your hosting provider for this critical task. Instead, it is strongly advised to take charge of your backups, even if your hosting company claims to handle them on your behalf. To ensure optimal security, store backup copies in multiple locations, and consider utilizing cloud services for the convenience of accessing your backups from any location.

At Crypadvise, we offer complimentary managed backups for all our customers, yet we strongly encourage each customer to maintain their backups as an additional safety measure. Remember, you can never have too many backups!

20. Utilizing a Powerful Password

We understand, we understand – we've already mentioned this before.

However, stressing the significance of a robust password policy is crucial, and it deserves repetition. Weak passwords remain the primary threat to security. This is equally applicable when it comes to securing Windows servers!

The password guidelines are frequently misinterpreted. While complexity plays a role, so does length. Opt for a password that includes a mix of uppercase and lowercase letters, numbers, and special characters, while also making it as long as practically feasible.

Communicate this message clearly to your users, and take proactive measures to enhance server security at the administrative level. Both cPanel and Plesk can be configured to enforce the use of strong passwords, and they can also be set to expire automatically.

Creating a strong password is essential for safeguarding your accounts. To ensure foolproof protection, consider the following top tips:

1. Length and Memorability: Opt for lengthy passwords that are easy for you to remember, but difficult for others to guess.
2. Avoid Dictionary Words: Steer clear of using common dictionary words like "greenapples," as they are easily trackable.
3. Steer Clear of Simple Number Replacements: Avoid using simple number replacements like "hell0," as they are predictable and weak.
4. No Pop Culture References: Refrain from using any references from pop culture, such as "ncc1701," as they may be easily recognizable.
5. Aim for Unpredictability: Make it challenging for anyone to guess your password by using a combination of characters, numbers, and symbols.
6. Unique Passwords: Never reuse the same password for multiple accounts; each should be distinct.
7. Separate Login Credentials: Your root (Linux) or RDP (Windows) login must have its own unique password for added security.
8. Regular Password Changes: For optimum protection, remember to change your password regularly.
9. Different Passwords for Different Websites: Use different passwords for each website or service to prevent potential breaches.
10. Keep it Confidential: Never write down your password, and never share it with anyone under any circumstances.
11. By following these guidelines, you can create robust passwords that significantly enhance your online security.

Conclusion:

The ramifications of vulnerabilities in web server infrastructure can be catastrophic. It's akin to being in shark-infested waters with an open wound.

A vast multitude of hackers worldwide continuously toil, relentlessly searching for even the slightest security weaknesses in your VPS. Consequently, it is imperative to fortify your VPS against potential threats since it's only a matter of time before hackers come knocking.

Corporate and e-commerce sites, in particular, have become prime targets for potential hackers. Despite the implementation of basic security measures by most companies, they often prove insufficient and are easily compromised.

Our comprehensive managed hosting services encompass security audits and hardening, ensuring the safety of your server while you concentrate on your core activities and expertise.