CS3226 Server Guide

cs3226securedo.md

Server Guide for CS3226

It is easy to get carried away with developing your web applications,but you should not neglect securing your server. Once your server is broken into, sensitive data like your OAuth keys, database access credentials etc. can get stolen. Even worse, imagine your app having no data because your database got wiped after a security breach...

Digital Ocean's Tutorials provides a list of things you can do to add some security to your server, but I will only cover the most basic of the list: securing login access. This is covered by Setting up SSH Key Login, but I highlight some things that are different from the tutorial.
Note: This guide assumes Unix/Linux environment. For Windows users, some additional Googling is required.

Create non-root user

Every server starts out with only the root user. Root users are all-powerful such that a wrong move can irrecoverably destroy your system. Thus, it is recommended to login as a non-root user. Since it's your own server, it is alright to create a user with sudo rights.

1. Log in as root using ssh root@<droplet_ip>.
2. Run useradd -m -s /bin/bash <username>.
3. Set password for the new user using passwd <username>.
4. Run visudo and add <username> ALL=(ALL:ALL) ALL. Save and exit the editor.
5. Log out of the session.

Public Key Authentication

1. Do step 3 of Setting up SSH Key Login guide.
2. Login as the new user you created. You should not be prompted for password at all.

Disabling Password Authentication

1. Follow step 4 of Setting up SSHKey Login guide. In addition, make sure RSAAuthentication and PubkeyAuthentication are set to yes and PaswordAuthentication is set to no.