A Practical Security Baseline for a New Cloud Server

A new server with a public address begins receiving automated login attempts within minutes. That traffic is indiscriminate and constant. The good news is that a short list of measures defeats essentially all of it.

1. Key-based SSH, passwords disabled

Authenticate with keys and turn password authentication off entirely in the SSH configuration. Automated attacks overwhelmingly guess passwords; removing that mechanism removes the attack. See SSH key hygiene.

2. No direct root login

Create an ordinary user with administrative escalation and disable root login over SSH. It gives you an audit trail of who did what and removes the single most-targeted username.

3. Default-deny firewall

Deny all inbound traffic, then permit only what is required: SSH from your address range where practical, and the ports your application serves. Configure both the provider firewall and the host firewall, since traffic must pass both.

4. Automatic security updates

Enable unattended security updates. Most compromises exploit vulnerabilities that were patched some time ago, and the gap between disclosure and exploitation is short.

5. Run services as non-root

A web server or application compromised while running as root gives away the machine. The same compromise under a limited service user is contained.

6. Reduce the listening surface

List listening ports and ask what each is for. Databases, caches and admin interfaces that only need local or private access should not be bound to a public interface, as covered in private networking between cloud servers.

7. Know when something changes

You do not need a full monitoring stack to start. Alerts on failed login volume, disk filling, and unexpected reboots catch a great deal. Ship logs off the machine so they survive it, as described in logging and audit trails.

8. Backups you have restored

Backups are a security control because they are the answer to destructive incidents. A backup nobody has restored is an assumption. Restore one, once, and note how long it took.

On inherited servers

Apply the same baseline, and additionally remove authorised keys you do not recognise, review scheduled tasks, and check for unexpected listening services. The full sweep is in auditing an unfamiliar cloud account.