Skip to main content

Security Methods

A. Use SSH Keys Instead of Passwords​

One of the main ways to improve SSH security is to use SSH key authentication instead of passwords.

Passwords can potentially be:

  • guessed
  • brute-forced
  • compromised

SSH keys use a cryptographic key pair:

Local Machine
├── Private Key
│
└── Public Key
        ↓
     Server

The private key stays with the user, while the public key is stored on the server.

When connecting:

This is why the server was previously configured to use SSH keys instead of password-based authentication.

B. Use a Firewall​

Another important security layer is a firewall.

A firewall controls which network traffic is allowed to reach the server.

A server does not need every network service to be publicly accessible.

The goal is to expose only the services that are actually required.

C. Keep Software Up to Date​

Security is not only about controlling who can access the server.

The software running on the server also needs to stay up to date.

Security vulnerabilities can be discovered in:

  • operating systems
  • applications
  • packages
  • libraries

Updates can contain patches that fix known vulnerabilities.

Running outdated software can leave known vulnerabilities available to attackers.

D. Other Security Tools​

The course also briefly mentions other security measures, including:

  • two-factor authentication
  • VPNs

A VPN is a Virtual Private Network.

It can create a trusted private network while placing a stronger boundary between that network and the outside internet.

Security often creates a tradeoff:

Security
→ Restrict access

Engineers
→ Need access

The goal is to find an appropriate balance between security and usability.

Ports and Firewalls​

E. What Is a Port?​

A port is a communication endpoint associated with a particular process or network service.

An IP address identifies the machine, while a port helps identify which service on that machine should receive the traffic.

IP Address
→ Which machine?

Port
→ Which service?

For example:

Server IP
│
├── Port 22   → SSH
├── Port 80   → HTTP
├── Port 443  → HTTPS
└── Port 3000 → Node.js application

This allows multiple network services to operate on the same machine.

F. Well-Known Ports​

Some ports are commonly associated with particular services.

Examples discussed in the course include:

21   → FTP
22   → SSH
80   → HTTP
443  → HTTPS

For example:

http://example.com
        ↓
      Port 80

and:

https://example.com
        ↓
      Port 443

Applications often use higher port numbers such as:

3000
8000
8080

to avoid conflicts with well-known services.

G. Why Open Ports Matter​

A network connection uses both an IP address and a port.

An open port means that a service can be reached through that port.

Because open ports provide ways to communicate with the machine, we should understand which ports are exposed.

The goal is:

Not:

Open everything

But:

Open only what the server needs

H. Scan the Server with Nmap​

The course uses Nmap to inspect which ports are open on the server.

Install it with:

sudo apt install nmap

Then run Nmap against the server's IP address.

The transcript runs the scan from the local machine against the Droplet's public IP:

nmap <server-ip>

Conceptually:

This allows us to see which network services are publicly reachable.

I. Identify Unnecessary Open Ports​

The scan shows ports such as:

22    → SSH
80    → HTTP
3000  → Node.js

Port 22 is needed because we use SSH to manage the server.

Port 80 is needed because Nginx receives HTTP requests.

However, port 3000 does not need to be directly exposed to the internet.

Our architecture is:

External clients should communicate with Nginx.

Nginx then forwards the request to Node.js.

Therefore:

Port 80
→ Publicly accessible

Port 3000
→ Does not need to be publicly accessible

J. What Is a Firewall?​

A firewall applies rules to incoming and outgoing network traffic.

At a high level:

This allows us to control which ports can be accessed from outside the server.

K. UFW — Uncomplicated Firewall​

Ubuntu provides a firewall management tool called UFW:

Uncomplicated Firewall

Firewall configuration traditionally involved more complicated tools such as iptables.

UFW provides a simpler interface.

Common operations include:

ufw allow
ufw deny
ufw reject

The purpose is to make firewall management easier.

L. Allow Only the Services We Need​

First, check the current firewall status:

sudo ufw status

Before enabling the firewall, allow the services that must remain accessible.

Allow SSH:

sudo ufw allow ssh

Allow HTTP:

sudo ufw allow http

The rules now conceptually look like:

Firewall
│
├── SSH / 22  → Allow
├── HTTP / 80 → Allow
└── Unnecessary traffic → Not allowed

Then enable the firewall:

sudo ufw enable

M. Do Not Lock Yourself Out​

When configuring a firewall on a remote server, it is important not to accidentally block your own SSH connection.

We use:

SSH
 ↓
Port 22

If port 22 is blocked:

Therefore, allow SSH before enabling the firewall:

sudo ufw allow ssh

Then:

sudo ufw enable

This prevents accidentally locking yourself out of the server.

N. Verify the Firewall​

After enabling UFW, check the firewall again:

sudo ufw status

The required services should remain accessible.

Conceptually:

UFW
├── SSH / 22  → Allowed
└── HTTP / 80 → Allowed

Port 3000 does not need to be directly exposed because Nginx receives the public request and proxies it to Node.js internally.

File Permissions​

O. Understanding r, w, and x​

Linux file permissions can be inspected with:

ls -la

Permission strings contain characters such as:

rwx

They mean:

r → read
w → write
x → execute

A missing permission is represented by:

-

For example:

rw-

means:

read    ✓
write   ✓
execute ✗

P. Permissions Are Divided into Three Groups​

Permissions are divided into three categories:

Owner
Group
Everyone Else

A permission string can therefore be viewed as:

rwx | rwx | rwx
 ↑     ↑     ↑
Owner Group Others

Each category can independently receive:

read
write
execute

permissions.

For example:

Owner  → read + write
Group  → read + write
Others → read

This allows Linux to control exactly who can do what with a file.

Q. Numeric Permissions​

chmod can represent permissions using numbers.

The values are:

read    = 4
write   = 2
execute = 1

The values are added together to represent combinations.

For example:

read + write

4 + 2 = 6

So:

6 → rw-

Another example:

read + write + execute

4 + 2 + 1 = 7

So:

7 → rwx

These numbers provide a convenient shorthand for setting permissions.

R. Understanding chmod 777​

Consider:

chmod 777 file

Each 7 means:

4 + 2 + 1
= read + write + execute

Therefore:

777

Owner  → rwx
Group  → rwx
Others → rwx

Everyone can:

  • read
  • write
  • execute

The course warns against using 777 simply to make a permission problem disappear.

Generally, we do not want to give everyone unnecessary access.

S. Understanding chmod 600​

Earlier, an SSH private key was configured using:

chmod 600 ~/.ssh/gh_key

Break down 600:

Owner
6 = 4 + 2
  = read + write

Group
0 = no permissions

Others
0 = no permissions

Therefore:

600
 ↓
rw-------

Only the owner can read and write the file.

Everyone else has no permissions.

This is useful for sensitive files such as SSH private keys.

T. Principle of Least Permission​

The course emphasizes the principle of least permissions.

The idea is:

Give users only the permissions they actually need.

Instead of:

Everyone
→ Can do everything

prefer:

Owner
→ Only what the owner needs

Group
→ Only what the group needs

Others
→ Only what others need

For example, if another user does not need permission to delete or modify a file, they should not receive that permission.

Giving unnecessary permissions creates unnecessary risk.

This applies both to malicious users and to accidental mistakes.

Automatic Security Updates​

U. Unpatched Software Is a Security Risk​

Keeping applications and the operating system updated is another important part of security.

Many attacks take advantage of vulnerabilities for which patches already exist.

The course mentions outdated WordPress installations as an example.

Even when a security fix exists, it cannot protect a system if the update is never installed.

V. Automate Updates with unattended-upgrades​

Ubuntu provides a package that can automate updates:

sudo apt install unattended-upgrades

The goal is to let the system periodically install updates without requiring us to manually perform the process every time.

Depending on the Ubuntu installation, this package may already be installed.

The course checks anyway to make sure it is available.

W. Configure Automatic Updates​

After installing the package, configure it using dpkg-reconfigure.

sudo dpkg-reconfigure --priority=low unattended-upgrades

When prompted to automatically download and install stable updates, select Yes.

The course wants automatic updates to run in the background.

Conceptually:

This reduces the need to manually remember to update the server.

X. Prefer Stable Updates on Servers​

The course emphasizes that servers should prioritize stability.

It mentions LTS:

LTS = Long-Term Support

The goal is not to automatically install every bleeding-edge package.

Bleeding-edge software may:

For servers, the course prefers software and updates that have been well tested.

Production Server
       ↓
Prefer
       ↓
Stable
Well-Tested
Long-Term Support

Reliability is more important than always running the newest possible software.

Y. Security Is Layered​

At this point, several security measures work together:

Server Security
│
├── SSH Keys
│   └── Avoid password-based authentication
│
├── Firewall
│   ├── Allow SSH
│   ├── Allow HTTP
│   └── Avoid exposing unnecessary ports
│
├── File Permissions
│   └── Give only necessary permissions
│
└── Software Updates
    └── Automatically install stable updates

The important idea is that server security is not based on one single mechanism.

Instead, multiple layers reduce different kinds of risk: