Sometimes, DigitalOcean suspends an account due to suspected security incidents. And, you get a security breach notice saying:
“Due to a history of activities on your account which are in violation of our Terms of Service, we are no longer able to provide you any further service. “
No one would like to see such a mail from DigitalOcean.
Fortunately, there are ways to avoid this by securing your Droplet.
At Bobcares, we help cloud server owners to secure their Droplets as part of our Managed Cloud Services.
Today, we’ll see how our Cloud Engineers avoid possible security breach in DigitalOcean Droplets.
What causes security breach?
Internet based attackers keep on finding new ways to attack vulnerable applications. They use bots that routinely crawls all IP numbers and look for web servers on the usual ports. On finding a target server, they inject malicious code and use it for spamming.
And, you come to know about it only after your server is suspended.
It is quite natural to forget about the security of the Droplet, when you are focused only on building the app. Unfortunately, when you overlook the security part, all your efforts in developing the app goes in vain.
Some of the most common reasons that can lead to security breach in a Droplet include:
- Using weak passwords for users
- Not securing applications
- Outdated software
How to avoid security breach in DigitalOcean Droplets?
In fact, building a secure environment in DigitalOcean Droplet is one of the biggest challenge that web developers face. Now, we’ll see how our Cloud Engineers prepare and fine tune the Droplet to avoid any security breach.
Let’s take a look at the major areas that we focus on.
1. Restrict SSH Access
Out of the reported DigitalOcean server compromise incidents, a major share happens due to lack of proper restriction for ssh access.
To avoid ssh compromise, the whole idea is to restrict the server access to the bare minimum. That’s why, our Support Engineers do tweaks like:
- Disable direct root login with password
- Set up ssh access keys
- Restrict IP address that can access the server via ssh
2. Setup Firewall
In addition to this, a firewall is essential for securing your DigitalOcean Droplet by restricting port access.
Therefore, our Cloud Engineers block all ports except those that require to be open. The list of open ports include web server port 80, mail server port 25, an so on.
Additionally, firewall helps to allow restricted access to selected IP addresses. This becomes really useful in granting ssh, MySQL access. Also, with firewall, we can block the access from a country as such.
3. Private networks
DigitalOcean allows the use of private networks. These private networks are only available to certain servers or users. Thus, it helps to isolate communication from public access.
For example, for accessing your data over different business location, we recommend configuring a private office network. Just to share the details to your colleague in a different country, you do not have to make the data available in internet.
Again, data on private network can be secured further by additional firewall policies too.
4. Close unused ports, services
Unused ports, services on your DigitalOcean Droplet can also become a common attack point.
For example, the Droplets running web apps do not need the mail port open. Or, the Droplet handling mails need not have to open the web server port too.
Therefore, our Cloud Engineers disable mail server, close port 25 on web app servers and restrict MySQL port access only to web servers. Thus, we add to the security of the server.
5. Regular monitoring
Even with all the security mechanisms in place, a new vulnerability can cause harm to your server. That’s where regular monitoring helps.
Our Support Engineers set up intrusion detection software, scripts to check root kits, etc. on the server. The email notification from these software are regularly monitored. Thus, we are able to patch up the server even before the exploit.
6. Isolating environments
From our experience in handling DigitalOcean Droplets, we see that it really helps to isolate your web apps from the database servers. This gives the flexibility of giving only web server to database server. And, we can restrict internet access to databases.
Also grouping web servers together, mail servers etc. allow us to apply specific firewall policy for each service.
7. Regular patching of apps
Last, but not the least, keeping all applications running on the server updated is really critical. Even when you have secured the entire server, a broken application can easily mess up the server. This application can be used to generate unwanted traffic which further leads to security breach.
That’s why, our Support Engineers regularly keep a track of the security patches, updates of common applications like WordPress, Joomla, etc. and install them.
[Worried about your server being a target for hackers? We can help to secure your DigitalOcean Droplet.]
Conclusion
Just like any other server, security is of prime importance in DigitalOcean Droplets too. Today, we’ve seen how our Cloud Support Engineers plan and set up Droplets to avoid security breaches.
0 Comments