Bureaucrats, cc_docs_admin, cc_staff
2,879
edits
Security considerations when running a VM: Difference between revisions
Security considerations when running a VM (view source)
Revision as of 18:57, 6 April 2017
, 7 years agocopy-edit, add some links
(copy-edit, add some links) |
|||
| Line 1: | Line 1: | ||
On the cloud, you are responsible for the security of your VMs. | On the [[CC-Cloud|cloud]], you are responsible for the security of your VMs. | ||
This document | This document cannot be a complete guide, but will set out some things you need to consider when creating a VM on the cloud. | ||
= | ==Keep the operating system secured== | ||
* Apply security updates | * Apply security updates. | ||
* Avoid using packages from unknown sources | * Avoid using packages from unknown sources. | ||
* | * Use a recent image. For example, don't use Ubuntu 14.04 when Ubuntu 16.04 is available. | ||
* Do not allow password authentication for SSH | * Do not allow password authentication for SSH. Use key authentication instead. | ||
* Install fail2ban to block | * Install [https://www.fail2ban.org fail2ban] to block brute-force attacks. | ||
=Network security= | ==Network security== | ||
* Limit who can access your service | * Limit who can access your service. Avoid using '''0.0.0.0''' in the CIDR field of the security group form. | ||
* | * Do not bundle ranges of ports to allow access. | ||
* | * Think carefully about your security rules. Consider the following: | ||
** | ** These services aren't meant to be publicly accessible: | ||
*** mysql | *** mysql | ||
*** postgresql | *** postgresql | ||
| Line 20: | Line 20: | ||
*** RDP | *** RDP | ||
*** ... many, many others | *** ... many, many others | ||
** Some services are meant to be accessible from the internet | ** Some services are meant to be accessible from the internet: | ||
*** Apache | *** Apache | ||
*** Nginx | *** Nginx | ||
| Line 26: | Line 26: | ||
* Configure your web server to use HTTPS instead of HTTP. | * Configure your web server to use HTTPS instead of HTTP. | ||
** In many case HTTP should only be used to redirect traffic to HTTPS. | ** In many case HTTP should only be used to redirect traffic to HTTPS. | ||
* Do not try to run a mail server. | |||