How servers get hacked
Almost every hack follows the same pattern. A bot scans the internet around the clock, finds a server with SSH or RDP open and starts guessing passwords. If the password is simple or has leaked, the bot gets in, gains a foothold on the server and uses it for its own purposes, for example for mining, sending spam or attacking other networks.
The good news is that a few simple steps protect against this. We have split them into separate guides, and each one takes 10–15 minutes.
Start with strong passwords
First of all, protect access to your client area and to the server itself. For the passwords to the client area, root, databases and any control panels, follow a few simple rules.
- a length of 16 characters or more, ideally 20 or more;
- a long phrase of 4–6 random words or a random string from a password manager works best;
- use a separate password for each service and never reuse the same password anywhere;
- if a service requires digits and special characters, add them, but do not make the password shorter.
The most convenient place to keep passwords is a password manager, so you do not have to remember them.
Step-by-step protection plan
Follow the guides in order, as the first three steps already block most real attacks.
- SSH key login and a separate user – the most important step, after which nobody can guess the password to your server.
- Firewall – we close every port except the ones you need.
- Automatic security updates – the server patches known vulnerabilities on its own.
- Changing the SSH port – removes most of the bots from the logs.
- Fail2ban – automatically blocks anyone who tries to guess passwords.
- Backups – insurance in case something does go wrong after all.
If you have a Windows server
The guides above are written for Linux. On a Windows server, what matters most is a long, unique administrator password and Remote Desktop (RDP) closed to outsiders. The best option is to allow connections to the RDP port in Windows Firewall only from your own IP address. We explained how to connect to a Windows server in the article on Remote Desktop.
If you have lost access to the server
Do not panic. In the server list in your client area there is a Console button, which opens the server right in your browser, even when SSH is unavailable. From there you can undo a setting that went wrong. If that does not help, send us a ticket and we will help you sort it out.
Our resources
Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com