Skip to main content

Why Security Is Critical

A. Security Is Critical​

Once a server is connected to the public internet, security becomes extremely important.

The course checks the server's authentication log after it has been online for about a day.

sudo cat /var/log/auth.log

The log already contains a large amount of activity, including attempts involving invalid users.

The important lesson is:

Once a machine is exposed to the internet, people and automated systems will constantly try to discover and connect to it.

This is why server security should be treated as a normal part of operating a server rather than something added later.

B. Public Servers Are Constantly Scanned​

A public server can begin receiving unwanted traffic almost immediately.

The course describes this as:

Attackers and automated systems continuously scan the internet looking for exposed machines and services.

This is why even a small personal server needs basic security practices.

C. Blocking Root Login Is Not Enough​

Previously, we disabled direct root login.

That is a useful security measure, but it does not mean the server is completely secure.

The important question becomes:

What happens if someone gains access to the server through another account or vulnerability?

Security therefore requires thinking beyond just protecting the root account.

D. What Can an Attacker Do?​

If someone gains access to the server, they may be able to use its resources.

For example, they could consume bandwidth by downloading large amounts of data.

The server could also be taken over and used as a bot to attack other websites or infrastructure.

So a compromised server is not only a risk to your own application.

It can become a tool for attacking other systems.

E. A Compromised Server Can Expose Other Systems​

The server may contain credentials that provide access to other services.

For example, we just placed a GitHub SSH private key on the server:

Server
└── ~/.ssh/gh_key

If an attacker gains sufficient access to the server, that credential may allow them to access GitHub through the compromised machine.

This demonstrates an important security principle:

Systems are connected, so compromising one machine can potentially provide access to other systems.

A single poorly secured server can therefore create a much larger security problem.

F. Attackers Can Hide Their Tracks​

Another problem is that attackers may modify or delete logs after gaining access.

For example:

They could potentially:

  • delete entire log files
  • remove specific lines from logs
  • hide evidence of their activity

This means that after a machine has been compromised, its current state can no longer necessarily be trusted.

G. You Do Not Know What Happened on a Compromised Machine​

The course gives an important rule:

On a compromised machine, you do not know what the attacker has done.

Even if you discover and fix the original vulnerability, the attacker may have already made additional changes.

Conceptually:

Because of this uncertainty, simply removing the obvious problem may not be enough.

H. Wipe and Restore a Compromised Server​

According to the course, if a machine has genuinely been taken over, the safer response is generally to wipe it and restore it from a trusted backup.

The reason is simple:

You know how they entered
        ≠
You know everything they changed

The attacker may have created additional ways to maintain access.

I. Attackers May Maintain Long-Term Access​

The course points out that serious attackers do not necessarily attack a machine and immediately reveal themselves.

They may remain inside a compromised system for a long period of time.

For example:

The course mentions cases where organizations believed they had fixed a breach while attackers still had persistent access through mechanisms such as rootkits.

The important idea is:

Serious attackers may play the long game.

They may prioritize remaining undetected rather than immediately damaging the system.

J. Security Matters Because Everything Is Connected​

A server rarely exists completely by itself.

It may connect to:

Server
├── GitHub
├── Application
├── SSH credentials
├── Other infrastructure
└── External services

Because these systems are connected, compromising one machine can potentially lead to other systems.

This is why the course emphasizes:

Security is paramount when it comes to servers because everything is connected.