Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

let's say you create a new instance on Amazon ec2 and you choose a default Ubuntu AMI. What things would you recommend for making the instance as secure as possible?


share|improve this question

This is a fairly nebulous question with answers that span books. It wouldn't matter where you were deploying to, you are talking about securing a Linux server.

share|improve this answer

What purpose are you deploying it for? Is this a web server, database, something else? To Nathans point, you are mainly talking about securing a Linux sever.

share|improve this answer

Elias: The quick answer is to decide which services you want to expose (ssh, http, https) and enable only those services on your machine. I usually assign ssh to a non-standard port (something other than port 22), as I've noticed brute force attacks occur there. Change the sshd port by editing /etc/ssh/sshd_config and restart the ssh service. Keep in mind that you can have a service running on the machine but still exclude access to it from via your security group.

Consider Fail2ban or alternatives to deflect brute force ssh attempts.

Don't overlook the obvious. I've watched attacks probe the standard LAMP stuff, checking for common passwords. Create user accounts with: sudo adduser --disabled-password, then copy your public key to the instance. Avoid services (ftp) that don't use a secure connection. My preference is to run web services over https rather than http.

I've not even scratched the surface, but if you apply a few commonsense procedures, you should avoid the most common generic attacks.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.