Securing up ubuntu on Amazon ec2

Question

let's say you create a new instance on Amazon ec2 and you choose a default Ubuntu AMI. What things would you recommend for making the instance as secure as possible?

Elias

Answer 1

This is a fairly nebulous question with answers that span books. It wouldn't matter where you were deploying to, you are talking about securing a Linux server.

Answer 2

What purpose are you deploying it for? Is this a web server, database, something else? To Nathans point, you are mainly talking about securing a Linux sever.

Answer 3

Elias: The quick answer is to decide which services you want to expose (ssh, http, https) and enable only those services on your machine. I usually assign ssh to a non-standard port (something other than port 22), as I've noticed brute force attacks occur there. Change the sshd port by editing /etc/ssh/sshd_config and restart the ssh service. Keep in mind that you can have a service running on the machine but still exclude access to it from via your security group.

Consider Fail2ban or alternatives to deflect brute force ssh attempts.

Don't overlook the obvious. I've watched attacks probe the standard LAMP stuff, checking for common passwords. Create user accounts with: sudo adduser --disabled-password, then copy your public key to the instance. Avoid services (ftp) that don't use a secure connection. My preference is to run web services over https rather than http.

I've not even scratched the surface, but if you apply a few commonsense procedures, you should avoid the most common generic attacks.