4

I'm a newbie in this world and I do not have a lot of knowledge about how security works on Linux systems. I recently created a droplet on DigitalOcean with Ubuntu 13 and I've been setting it up by following some of the tutorials they have.

But I can see that there are a lot of security tools that do mostly the same thing, so I am unsure what I should install and configure. So far this is what I installed:

Is this too much or maybe overreacting? And are any of the above unnecessary? Does anyone suggest some other tools besides the above that I should install?

EDIT: I ended up installing/setting up the following:

I hope that now I got a basic security setup running. Any input on what I am missing or what I should not use is appreciated.

  • 1
    Whether it is too much or too little depends entirely on what risks you are trying to mitigate. What are you planning to do with the server? – Jos Apr 13 '14 at 10:17
  • It's going to be a web server, it will run a public website and API (running on ruby with postgresql, memcached and redis) – Roland Apr 13 '14 at 10:25
2

It's about process and policy as well as tools. I think you need a more holistic approach such as those outlined in the CIS benchmarks. I would consult the new Ubuntu one just released as well as the Apache one if you'll be running Apache as your web server.

Ubuntu CIS Benchmark

https://benchmarks.cisecurity.org/downloads/show-single/?file=ubuntu1204.100

Apache CIS Benchmark

https://benchmarks.cisecurity.org/downloads/show-single/?file=apache24.110

  • I will actually be running varnish on a machine, nginx on some other machines and a ruby http server on others. I'll take a look at the CIS benchmark though to see what is that about, thanks :) – Roland Apr 17 '14 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.