Basic server security setup

A server open to the internet starts receiving automated login attempts as soon as it's created. Doing just the few things below when you first connect blocks most attacks.

The password on your Dashboard is the password issued when the server was created. If you change the password inside the server, the Dashboard value no longer matches, so keep your new password somewhere separate, such as a password manager. If you forget it, there's no way to log in.

Linux (Ubuntu) server

1. Update the system

sudo apt update && sudo apt upgrade -y

2. Change the password

passwd

Enter your current password, then enter the new password twice. We recommend at least 12 characters mixing letters, numbers and symbols.

3. Allow login with SSH keys only (recommended)

Turning off password login stops password brute-force attacks at the source.

1. First, register a key as described in "Connecting without a password using SSH keys" in the SSH connection guide, and check in a new window that you can log in with the key.
2. Open the configuration file.

sudo nano /etc/ssh/sshd_config

3. Find the PasswordAuthentication line and change it as shown below. (If there's a # in front of it, remove it.)

PasswordAuthentication no

4. If a file in the /etc/ssh/sshd_config.d/ folder contains PasswordAuthentication yes, that setting takes priority, so change it to no as well.

grep -r PasswordAuthentication /etc/ssh/sshd_config.d/

5. Restart SSH.

sudo systemctl restart ssh

⚠️ Don't close the window you're connected in now; close it only after checking in a new window that you can log in with the key. If the key setup is wrong, you could be locked out. If that happens, you can get in through the browser console (VNC) and undo the setting.

4. Automatically block login attacks (fail2ban)

It automatically blocks IPs that fail to log in several times, for a set period. Just installing it turns on SSH protection by default.

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

5. Firewall

Opening only the ports you need makes the server safer. See Opening firewall ports.

6. Backups

Apart from security settings, be sure to keep important data outside the server as well. Backing up your server data

Windows server

1. Windows Update: Install updates in Settings → Windows Update and reboot.
2. Change the password: While connected via Remote Desktop, press Ctrl + Alt + End → select Change a password.
3. Tidy up programs you don't use: Don't open ports for programs that don't need to be public (DB admin tools, etc.). See Opening firewall ports.

Your Nevv account too

Separately from your server password, we recommend turning on two-factor authentication for your Nevv account.