Skip to Content

First Login and Server Security

First Login and Server Security

Connect to your server and lock it down

Your server is running in the cloud with a public IP address — that means anyone on the internet can try to connect to it. Before installing anything, we need to secure it. This lesson covers your first SSH login and essential security hardening.

Connect to Your Server

First connection
ssh root@YOUR_SERVER_IP

First Connection

The first time you connect, SSH will ask you to verify the server fingerprint. Type yes to accept it. This only happens once.

Create a Non-Root User

Running everything as root is dangerous. A single mistake can destroy the entire system. Create a regular user with sudo privileges instead.

Create deploy user
adduser deploy
usermod -aG sudo deploy

# Copy SSH key to new user
mkdir -p /home/deploy/.ssh
cp ~/.ssh/authorized_keys /home/deploy/.ssh/
chown -R deploy:deploy /home/deploy/.ssh
chmod 700 /home/deploy/.ssh

Disable Root and Password Login

Harden SSH
# Edit SSH config
sudo nano /etc/ssh/sshd_config

# Set these values:
PermitRootLogin no
PasswordAuthentication no

# Restart SSH
sudo systemctl restart sshd

Test Before Disconnecting

Before closing your root session, open a NEW terminal and verify you can log in as the deploy user. If the new login fails, you still have your root session to fix it.

Set Up the Firewall

Configure UFW
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status
1

Allow SSH

Port 22 must stay open or you will lock yourself out of the server.

2

Allow HTTP and HTTPS

Ports 80 and 443 for web traffic. Required for your Varyshop and SSL certificates.

3

Enable the firewall

All other ports are blocked by default. Only the three ports above will accept connections.

Keep the System Updated

Enable auto-updates
sudo apt update && sudo apt upgrade -y
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Automatic Security Updates

Unattended-upgrades will automatically install security patches. This is critical for a server exposed to the internet.

Server Secured

Your server now has SSH key-only authentication, a non-root user, a firewall allowing only necessary ports, and automatic security updates. This is a solid foundation for running Docker and Varyshop.

Bezpečně se připojte k novému serveru, zabezpečte ho pravidly firewallu a fail2ban a nastavte doménové jméno.

Rating
0 0

There are no comments for now.

to be the first to leave a comment.