Linode: Foundations of Web Server Security

Sign up at linode.com and confirm your email to create a Linode account. Enter billing details and accept the temporary $1 hold to access the cloud manager.

Explore the Linode cloud manager dashboard, navigate the left navigation menu, manage instances and block storage volumes, and access the marketplace, account dashboard, and learning resources.

Enable two-factor authentication on your Linode account to secure login with knowledge and possession factors, protecting against unauthorized access and safeguarding resources. Install Google Authenticator on your mobile device, scan the QR code from the Linode dashboard, enter the generated token, securely save the scratch code, and test the setup by logging out and back in.

Deploy a Linode instance with Ubuntu 20.04 LTS, in Newark, New Jersey, using a 1 GB RAM, 1 CPU, 25 GB root volume plan, and set a strong password.

Explore the Linode instance dashboard, monitor deployment status, and manage resources—from IP addresses, volumes, and configurations to analytics, backups, and settings.

Learn how to securely connect to a Linode instance to administer it via the command line, update the operating system, install security patches and firewall rules, and monitor performance.

Explore how password brute-force risks motivate SSH key authentication with OpenSSH. Use a private key and public key pair for secure remote access, file transfers, and remote command execution.

Generate a 4096-bit ssh key pair with Puttygen on Windows, save the public key to Linode and the private key for Putty, and configure ssh key authentication for remote login.

Generate an ssh key pair on macOS or Linux, save with default names, protect with a passphrase, copy the key to a Linode instance, and connect via ssh key authentication.

Connect to your Linode instance remotely via the web-based lish console from the Linode Cloud Manager, log in as root, and safely terminate sessions to prevent unauthorized access.

Add and manage SSH public keys in the Linode cloud manager to enable future instance deployments, showing how to label, paste, and apply keys across deployments.

Explore the fundamentals of the Linux kernel and distributions, compare Linux with Windows, and identify core components like bootloaders, memory management, and Apache and Nginx as common server software.

Discover the Linux file system's hierarchical structure, mastering absolute and relative paths from the root / and navigating key directories like /bin, /boot, /home, and /var.

Connect to your Ubuntu server via PuTTY and log in to administer maintenance commands. View updates with apt list --upgradable, then use apt update, upgrade, dist-upgrade, install, and remove.

Navigate the linux file system with cd, pwd, and ls; move between root and system root, explore /var, and create and save files with nano.

Learn essential Linux directory commands—mkdir, mv, cp, rm—navigate and manage files and directories, including recursive copying and deletion, while observing colorized output and filesystem structure.

Set the host name to Saturn, map the public Linode IP in the hosts file, and configure time, zone, and rtc with time date ctl.

Understand root account risks, and learn how non-root accounts, groups such as the pseudo or wheel group, and the pseudo and su commands manage administrative and superuser privileges.

Create a non-root user named Bob, add him to the sudo group to enable superuser privileges, and verify that Bob is in the sudo group.

Secure the Bob user with ssh key authentication by generating a new 4096-bit key pair, adding the public key to Bob's authorized keys file, and enabling sudo for admin tasks.

Disable root login and plain password authentication to enforce ssh key authentication and strengthen server security, configure sshd_config, restart ssh, and verify access with key-based login.

Install and configure the lamp stack on Ubuntu using the command line, including Apache, MariaDB, and PHP, then verify the setup and security basics.

Learn to install a lamp stack using the Linode marketplace one-click app during deployment, configure mysql root and ssl, and test via the server IP before deletion.

Log in to your server and create a PHP info page in the Apache web root to verify PHP is running and view configuration; delete the file later.

Learn how to connect to MariaDB from PHP, create a database and a non-root user, grant privileges, then create a table, insert sample data, and verify access.

Create a php script in the web root with nano to connect to the database and output all records from the name list table as an HTML ordered list.

Learn to administer a Linode instance with a graphical desktop via the glitch console and xfce, including updating packages, installing xfce4, starting the desktop, and navigating /var/www/html.

Secure the hosting environment by configuring firewalls, monitoring networks, and applying server security best practices. Guard against DDoS, directory traversal, and brute-force attacks through Apache configuration and robust access controls.

Configure a firewall to shield your server by filtering connections, scanning for malicious code and suspicious source ip addresses, and enforcing port rules for http and ssh.

Configure a network firewall in the Linode console to control inbound traffic. Block incoming http requests on port 80 with a drop rule and save changes.

Change the SSH port from 22 to a custom port, restrict SSH access to trusted IPs via the Linode firewall, and verify connectivity using a secure SSH client.

Implement a strict inbound firewall policy on a Linode by dropping default traffic, enabling HTTP, HTTPS, DNS, MySQL, and ICMP inbound rules, then save changes and verify the page loads.

Configure a hosted firewall on Ubuntu using ufw. Set default incoming policy to deny and allow outgoing, then open ssh port 9555 along with 80, 443, 3306, and 53.

Learn how SSL certificates secure communication and verify identity, including how certificate authorities like Digicert, GoDaddy, GlobalSign, and Let's Encrypt issue trusted digital certificates.

Compare traditional and digital certificates by who they are issued to and their renewal, noting digital certificates include public keys and digital signatures from trusted certificate authorities.

Explore the types of SSL certificates, including domain validation, organization validation, and extended validation, guided by EVT guidelines and Letsencrypt, and learn how each verifies domain ownership and entity legitimacy.

Learn how SSL certificates use a digital signature and hash value to verify authenticity, protect data with public and private keys, and ensure domain name matching.

Obtain and install an ssl certificate from a certificate authority like digicert, verify domain ownership, and ensure browser trust by validating the certificate's legitimacy and integrity during https connections.

Explore how Let's Encrypt automates certificate issuance, enabling free, secure TLS encryption on cloud servers, demonstrated by installing a certificate on a digital ocean droplet with Ubuntu 16.04.

Register a domain name and create a DigitalOcean droplet to prepare your server; note certificates need more than a public IP, and a free $10 credit may apply.

Configure your domain to point to Digital Ocean by updating your registrar's name servers to ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com, ensuring they replace any existing provider.

Sign up for a digital ocean account, activate via email, and enter billing details to create your first droplet, noting a brief minimal cost via PayPal.

Switch to hourly pricing and use the smallest droplet at 0.07 per hour with 512MB memory, one core, 20GB SSD, 1 TB transfer, and SSL certificates on any configuration.

Create a digital ocean droplet by selecting Ubuntu 16.04 64 bit, the smallest size, and the New York data center, then set the hostname to my server.

Learn to install and use PuTTY or terminal to connect to a Digital Ocean droplet, log in as root, change the initial password, and begin server configuration.

Install and configure a lamp stack on a virtual machine, including Apache, MySQL, PHP, and phpMyAdmin; test the web server and plan to enable https with Let's Encrypt.

Configure the domain name system on Digital Ocean to map your domain to your server by adding an A record and a CNAME. Wait 24 to 48 hours for propagation.

Add the server's IP address and domain name to the hosts file, adjust the server time to eastern time, and configure a cron job to renew the Letsencrypt certificate.

Install the let's encrypt client, set up an ssl certificate for your domain, and redirect all traffic to https to improve security and search rankings.

Review SSL certificate status regularly to avoid warnings from CA cancellations, and verify common names and validity dates. Note the 2048-bit RSA key and the Let's Encrypt certificate authority.

set up apache to redirect all domain variations (www, non-www, ip, http) to https and the base domain by configuring an htaccess, restarting apache, testing, and scheduling ssl renewal.

Create a cron job in Ubuntu to automatically renew the SSL certificate every Monday at 3:30 a.m., using Let's Encrypt and logging output to a renewal log in /var.