With the recent incident of NewsBlur (https://news.ycombinator.com/item?id=27613217), I was wondering how do you guys secure a server on the internet immediately after it boots. I usually do this:
1. terrafom to "create" the infrastructure. Basic security (ssh root login with keys). Servers are running nothing yet (no webserver, no databases, no nginx, etc.)
2. after everything has been created I use Ansible to provision the servers. Is in this moment when I apply all the "best practices" regarding security (remove root login, don't allow root password login, perhaps even change default ports, use a bastion host, setup passwords and certificates for internal servers, improve the firewall rules)
I don't run anything critical yet, but I wouldn't like to get compromised. Any suggestions or resources I can read so I can improve the security of my services?
1. terrafom to "create" the infrastructure. Basic security (ssh root login with keys). Servers are running nothing yet (no webserver, no databases, no nginx, etc.)
2. after everything has been created I use Ansible to provision the servers. Is in this moment when I apply all the "best practices" regarding security (remove root login, don't allow root password login, perhaps even change default ports, use a bastion host, setup passwords and certificates for internal servers, improve the firewall rules)
I don't run anything critical yet, but I wouldn't like to get compromised. Any suggestions or resources I can read so I can improve the security of my services?