How to Secure a Live Server?

Securing a live server is crucial to protect against unauthorized access and potential threats. Implementing robust server security best practices ensures that your server remains protected and operational. This guide will outline how to secure a live server, covering essential steps such as server hardening techniques, secure server configuration, and ongoing server vulnerability management. By following these guidelines, you can effectively protect your live server from potential attacks and breaches.

How to Secure a Live Server?

Method 1: IP tables

IP tables are command-line firewall utility that uses rules/policies to allow or block traffic. First, check if your iptable configuration is clean. 

sudo iptables -L

The above command lists all the current iptable rules. Use this command after every addition to ensure that your configuration is clean.

if you find some issues in your configuration, you can use the following command to flush the entire iptable and start over. With your iptable flushed, your system is vulnerable to attacks. Make sure to secure it using an alternative method.

sudo iptables -F

Inserting rules

Insert rules for the following purposes to secure the server.

• Inserting rule to allow loopback connections for localhost connection to work.
• Inserting rule to allow incoming connection from the already established connection.
• Rule to allow HTTP on port 80, HTTPS on 443, and SSH on 22.

Let's add a rule to allow established connections to continue using the command below and then you can check that the rule was added using the same sudo iptables -L as before. To do this enter the following command in the terminal.

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -L

Default policy

You should make sure of the default policy to be configured as accepting incoming connections. This ensures that you don't get locked out of your account. Then, add a rule to drop the incoming connections as last. This ensures to drop of the connection if the packet doesn't match the rules above drop rule. Thus, ensures security from unwanted connections to the server.

Setting the default policy as 'ACCEPT'

sudo iptables -P INPUT ACCEPT

Adding a rule to 'DROP'

sudo iptables -A INPUT -j DROP

These commands execute successfully without returning any statement as can be seen from the screenshot provided below.

Setting the iptables to be persistent 

Before setting the rules permanently, testing it once would be good to ensure that you're able to log back in if you get logged out. Once, that is done you can use the following command to make the rules permanent. This command created a script that loads our configuration when the system reboots.

sudo apt-get install iptables-persistent

Now, whenever you need to add more roles to iptables-persistent, you need to update the same using the following command.

sudo invoke-rc.d iptables-persistent save

Method 2: IPV6

The above rules are for IPV4 and adding rules for IPV6 differs a bit in the command statement. The adoption of IPV6 is still not much compared to IPV4 and it could be exploited if left open. Therefore, let's add a default policy to it and make it permanent. You can follow the commands mentioned below,

sudo ip6tables -L
sudo ip6tables -P INPUT DROP
sudo invoke-rc.d iptables-persistent save

Commands for IPV6 only differ in the keyword 'ip6tables' w.r.t IPV4.

The server is up or not

We've allowed all important protocols to establish a connection to our servers. But if you try to ping the server right now, it'll drop because of the rule we added at the last. Thus, we need to allow ICMP for the same. Also, we want the drop rules to be the last rule defined. Thus, we need to add this rule above the DROP rule. To achieve the same, you can follow the below commands.

To get the line number to all the rules

sudo iptables -L --line-numbers

sudo iptables -I INPUT [Drop_rule_line_number] -p icmp --icmp-type echo-request -j ACCEPT

This rule will be added at line 1 and the DROP rule at 1 will be shifted down

Now it allows us to ping the server again.

Conclusion

Effective server security is key to maintaining a safe and reliable live server environment. By adhering to server security best practices and utilizing live server protection techniques, you can significantly reduce the risk of vulnerabilities and attacks. Regularly updating your secure server setup and monitoring for potential threats will ensure that your server remains secure and functional over time. Embrace these strategies to uphold the integrity and security of your live server.