Server Security & Hardening

Overview

This page covers the defensive infrastructure and system-level security measures that protect our servers from intrusion, unauthorized access, and exploitation. While our companion page “Security Monitoring & Reputation Management” focuses on detecting external threats and protecting our public reputation, this page focuses on preventing attacks at the infrastructure level.

Key Focus Areas:

  • Securing the operating system and server software
  • Preventing unauthorized access
  • Protecting against code injection and exploitation
  • Hardening databases and applications
  • Managing user permissions and access control
  • Securing backups and logs

Relationship to Other Security Measures:

  • Security Monitoring & Reputation Management: Detects threats, monitors reputation, scans for malware → watches for problems
  • Server Security & Hardening (this page): Prevents intrusions, hardens systems, controls access → prevents problems

Document Structure Guide

This page will be expanded to cover the following topics in detail. Each section will focus on free/low-cost tools and best practices aligned with our zero-overhead operational model.

1. Operating System Hardening

Purpose: Secure the foundation of our server infrastructure

Topics to cover:

  • Minimal installation (remove unnecessary packages)
  • Disable unused services and ports
  • Keep system updated (automated security patches)
  • Configure secure system defaults
  • File system permissions and access control
  • Kernel security parameters (sysctl)
  • SELinux or AppArmor configuration

Free Tools:

  • Built-in OS security features (SELinux, AppArmor, UFW)
  • Unattended-upgrades (Debian/Ubuntu)
  • Lynis security auditing tool

2. Firewall Configuration

Purpose: Control network traffic and prevent unauthorized access

Topics to cover:

  • Default deny policies (whitelist approach)
  • Port management (only open necessary ports)
  • Rate limiting to prevent DDoS
  • Geo-blocking if needed
  • Firewall rule organization and documentation
  • Testing firewall effectiveness

Free Tools:

  • UFW (Uncomplicated Firewall) for Ubuntu/Debian
  • firewalld for CentOS/RHEL
  • iptables (underlying tool)
  • Fail2ban for intrusion prevention

3. SSH Security

Purpose: Secure remote server access

Topics to cover:

  • Disable password authentication (key-based only)
  • Change default SSH port
  • Disable root login
  • Configure SSH key management
  • Use SSH key passphrases
  • Implement two-factor authentication (2FA) for SSH
  • Limit SSH access by IP/user
  • SSH session timeout configuration
  • Monitor SSH logs for suspicious activity

Free Tools:

  • Built-in SSH configuration
  • Google Authenticator for 2FA
  • Fail2ban for brute-force protection

4. User Access Control

Purpose: Implement principle of least privilege

Topics to cover:

  • User account management
  • Sudo configuration (limit who can do what)
  • Service accounts (run services as non-root users)
  • Password policies (complexity, rotation)
  • Disable/remove unnecessary user accounts
  • Audit user permissions regularly
  • Session management and timeout policies

Free Tools:

  • Built-in Linux user management (useradd, usermod, etc.)
  • PAM (Pluggable Authentication Modules)
  • sudo configuration files

5. Database Security

Purpose: Protect sensitive data and prevent SQL injection

Topics to cover:

  • Database user permissions (least privilege)
  • Disable remote root access
  • Use separate database users per application
  • Bind database to localhost only (if possible)
  • Regular database backups
  • Encrypt sensitive data at rest
  • SQL injection prevention (prepared statements, parameterized queries)
  • Database connection security (SSL/TLS)
  • Monitor database logs for suspicious queries

Free Tools:

  • Built-in database security features (MySQL, PostgreSQL)
  • Database-specific security guides
  • Application-level prepared statements

6. Application Security

Purpose: Prevent code exploitation and injection attacks

Topics to cover:

  • Input validation and sanitization
  • Output encoding
  • SQL injection prevention (parameterized queries)
  • Cross-Site Scripting (XSS) prevention
  • Cross-Site Request Forgery (CSRF) protection
  • Command injection prevention
  • File upload security
  • Session management and security
  • API security (authentication, rate limiting)
  • Dependency management (keep libraries updated)
  • Security headers (CSP, X-Frame-Options, etc.)
  • Environment variable security (.env files)
  • Secret management (API keys, passwords)

Free Tools:

  • OWASP dependency checker
  • npm audit / pip-audit
  • Security linters for your programming language
  • Git-secrets (prevent committing secrets)

7. Web Server Security

Purpose: Harden Apache/Nginx and prevent exploits

Topics to cover:

  • Disable directory listing
  • Hide server version information
  • Configure security headers
  • Rate limiting
  • Request size limits
  • Timeout configuration
  • SSL/TLS configuration (strong ciphers only)
  • Disable unnecessary modules
  • Separate web server user from other services
  • Web Application Firewall (WAF) rules

Free Tools:

  • ModSecurity (open source WAF)
  • Built-in Apache/Nginx security features
  • Let’s Encrypt for SSL certificates
  • SSL configuration generators (Mozilla SSL Config Generator)

8. Backup Security

Purpose: Ensure backups are secure and recoverable

Topics to cover:

  • Automated backup scheduling
  • Backup encryption
  • Off-site backup storage
  • Backup integrity verification
  • Secure backup access (limited permissions)
  • Backup retention policies
  • Test restoration procedures regularly
  • Protect against ransomware (immutable backups)
  • Document backup procedures

Free Tools:

  • rsync for file backups
  • mysqldump / pg_dump for database backups
  • Duplicity for encrypted backups
  • Restic for encrypted, deduplicated backups
  • Cloud storage free tiers (Google Drive, Backblaze B2 free tier)

9. Log Monitoring & Intrusion Detection

Purpose: Detect and respond to security incidents

Topics to cover:

  • Centralized logging
  • Log rotation and retention
  • Monitor authentication logs
  • Track failed login attempts
  • Application error logs
  • Database query logs (for suspicious activity)
  • File integrity monitoring
  • Automated alerting for suspicious activity
  • Log analysis tools

Free Tools:

  • Fail2ban (ban IPs after failed attempts)
  • Logwatch (log analysis and reporting)
  • AIDE (Advanced Intrusion Detection Environment)
  • Built-in syslog/journald
  • Grep and awk for log analysis

10. SSL/TLS Configuration

Purpose: Secure communications and data in transit

Topics to cover:

  • Strong cipher suites
  • Disable outdated protocols (SSL, TLS 1.0, TLS 1.1)
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • Certificate pinning (if applicable)
  • OCSP stapling
  • Automated certificate renewal

Free Tools:

  • Let’s Encrypt
  • Certbot
  • SSL Labs testing (see Security Monitoring page)
  • Mozilla SSL Configuration Generator

11. Container Security (If Using Docker/Containers)

Purpose: Secure containerized applications

Topics to cover:

  • Use official/trusted base images
  • Keep images updated
  • Don’t run containers as root
  • Limit container resources
  • Network isolation
  • Scan images for vulnerabilities
  • Secrets management in containers
  • Container runtime security

Free Tools:

  • Docker Bench Security
  • Trivy (vulnerability scanner)
  • Clair (image scanner)
  • Docker built-in security features

12. API Security

Purpose: Protect API endpoints from abuse and unauthorized access

Topics to cover:

  • Authentication (OAuth, JWT, API keys)
  • Authorization (role-based access control)
  • Rate limiting per user/IP
  • Input validation
  • HTTPS only
  • CORS configuration
  • API versioning
  • Monitor for API abuse
  • Document security requirements

Free Tools:

  • Built-in framework security features
  • Rate limiting middleware
  • JWT libraries for your language

13. Regular Security Maintenance

Daily:

  • Monitor security alerts/logs
  • Check for failed login attempts
  • Review automated backup status

Weekly:

  • Review system logs for anomalies
  • Check for available security updates
  • Verify backup integrity

Monthly:

  • Apply security updates
  • Review user access permissions
  • Test backup restoration
  • Review firewall rules
  • Audit sudo access
  • Check for unnecessary running services

Quarterly:

  • Run security audit tool (Lynis)
  • Review and update security policies
  • Penetration testing (if resources allow)
  • Review SSL/TLS configuration
  • Update dependencies and libraries

Annually:

  • Comprehensive security review
  • Disaster recovery drill
  • Review and update all documentation

Quick Start Priorities

When first setting up servers, tackle these areas in order:

  1. SSH Security – Secure remote access immediately
  2. Firewall Configuration – Lock down network access
  3. OS Hardening – Secure the foundation
  4. User Access Control – Implement least privilege
  5. Automated Backups – Protect against data loss
  6. Database Security – Protect sensitive data
  7. Application Security – Prevent code exploits
  8. Log Monitoring – Detect incidents early

Resources for Later

Security Hardening Guides

Free Security Tools

Security Checklists

Cross-References

Related Documentation:

  • Security Monitoring & Reputation Management – External threat detection and brand protection
  • Servers Section – General server setup and management
  • Database Documentation – Database-specific configurations
  • Deployment Procedures – Secure deployment practices

Notes for Future Expansion

This is a placeholder/outline page. Each section above should be expanded into detailed procedures, specific commands, configuration examples, and troubleshooting guides as we implement these security measures.

Remember our core principles:

  • Use free/open source tools whenever possible
  • Document everything we do
  • Test before implementing in production
  • Keep security measures maintainable by a small team
  • Balance security with usability
  • Focus on the most impactful measures first

claude.ai – if you register and save all your conversations it will remember it all and use it as context, meaning you can save a lot of typing, it will incorporate things from other converations as well as your immediate prompts.