Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

General Discussion

Posted by Florian Glembotzki
Florian Glembotzki
Courses Plus Student 4,370 Points

Virtual Server Security Checklist Ubuntu 14.04

Hi, I'm looking for a security checklist for a virtual server at some hosters like strato.

I started experimental setups on a local machine with MAMP and another with Ubuntu 14.04. Now I want to run my Website and all the PHP Code on this Virtual Server. But at the moment I'm afraid to become hacked.

Here's a list with things I already have done on the local system.

  • apt-get update
  • apt-get upgrade
  • adduser xxxxx
  • adduser xxxxx sudo
  • addgroup --system sshusers
  • adduser xxxxx sshusers
  • sshd_config ->{ LoginGraceTime 30 AllowGroups sshusers PermitRootLogin no StrictModes yes}
  • /etc/init.d/ssh restart
  • login with user xxxxx
  • sudo ufw allow 22
  • sudo ufw allow 80
  • sudo ufw allow 443
  • sudo ufw default deny
  • sudo ufw enable
  • sudo restart ssh
  • /etc/init.d/apache2 restart

Apache2, PHP and MySQL are already installed with apt-get install.

Puh... so is anything ok? Do you have any recommendation what to do next?

1 Answer

Merritt Lawrenson
Merritt Lawrenson
13,477 Points
Merritt Lawrenson
Merritt Lawrenson
13,477 Points

Digital Ocean has a really good article about this at: https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps

It looks like you've already got your non-root user set up and your firewall configured. The article has some extra tips about preventing intrusions you should find useful and some general tips and best practices.