Secure VPS in Ubuntu 18.04 with Letsencrypt Nginx PHP MySQL

It is time to choose a VPS provider to create an account in it. DigitalOcean is used in the course, but you are free to pick any other provider like Linode, Rackspace or whatever you like.

Create an account in the provider used during the course (DigitalOcean). Again, you do not have to use DigitalOcean, but I can recommend it.

Through the question system, you can solve your doubts, but it is very important that you ask them in the right way to help you better.

If you are on Windows, it is essential to allow some commands that will be used throughout the course to generate SSH keys and establish SSH connections with the VPS. Note: If you are not on Windows, you may not have to follow these steps. Anyway, make sure you can use commands like "ssh" and "ssh-keygen."

The SSH keys are files used to establish SSH connections, which is a secure authentication mechanism that will allow us to connect to our VPS server, without relying on traditional passwords.

It is time to access DigitalOcean or the provider you have chosen to deploy the VPS instance with Ubuntu 18.04.

Let us see how to use the ssh command to establish connections to our VPS utilizing the SSH keys that we have created.

Since we are using SSH keys whose name is not the default one used by the ssh command, it becomes quite annoying to have to specify the full path of the SSH key each time. During this class, you will see how to create aliases that allow you to forget all parameters such as username, IP address, along with the location of the SSH key.

By default, SSH connections established with the server are closed after 5 minutes of inactivity. This is quite annoying, so let us configure our system to avoid this to happen anymore.

Let us see how to manage the different DNS entries in your VPS provider so that you can point your acquired domain and any subdomain to the IP address of the VPS server.

Once you have a domain, it is essential to tell the provider of that domain, to look at the servers of DigitalOcean or the provider you have chosen, allowing to manage the different DNS entries from there.

To work with your VPS, you will have to move constantly throughout the different locations of it. Let us see the use of the different commands that will allow us to know the content of a location, along with moving between them.

It is a common task, having to create, and manage any type of file when you manage a VPS server. In this class, I will show you the use of the different commands that will be useful for managing files and working with your content.

During the course, we will need to create, move, and manage directories in general. In this class, I will show you the use of the different commands that will be useful for managing directories in the whole file system of your VPS.

When you work with your VPS, the use of the console is imminent, so during this class, I will share some tricks that will help you be much agiler and efficient when writing and executing commands.

Keeping your VPS updated is very important, so during this class, you will learn how to use the apt command to manage the different packages of your VPS server.

Learn how to use the systemctl command to manage the different system processes of your VPS. This is especially useful for managing PHP, Nginx and MySQL processes later.

From time to time, the VPS server will ask you to reboot. The process is quite simple, but it has some previous considerations. Know the factors to consider before reboot your VPS and, of course, how to do it.

Know the different commands that are used to manage user accounts (create and delete).

After creating a user, it is possible to log in with them, but some things must be prepared before they can do so. Let us see what.

Each user created has limited capabilities. To be able to give it more capability and assign it as a privileged user, it is necessary to do it explicitly. Let us see how.

The final safety touch will be to prevent any person or system from logging in as the root user directly. In this way, you will have absolute security that no one will have administrative permits unless they assigned and know the password that given when creating the account.

Close all possible ports of the VPS, to avoid any kind of attack on the multiple ports that your VPS can have, using a firewall. Therefore, you will only have open those ports you need, and you will have a more rigorous control.

Meet two commands used to give permissions over locations: chmod and chown. Learn the difference between those commands and, why it is preferable to use chown.

With Fail2Ban, you can control and keep at bay the automated systems that are continually trying to access your VPS through SSH.

Time to install the web server. In this case, we will use Nginx because it is an excellent alternative, even superior to Apache.

Despite having a web server, capable of receiving requests to port 80 (HTTP), these still fail because our firewall has blocked this port. Let us see how to enable this port along with port 443 for HTTPS.

Since you have Nginx installed and functional, look at its structure and its main files and locations.

Let us see a bit about the virtual hosts that allow Nginx to determine how to respond to one request or another, as well as the differences between the sites-available and sites-enabled folders.

Now that everything is clear about Nginx, its structure, and the virtual hosts, it is time to deploy the first site (the main site) by applying all learned in previous classes.

We are going to extend the process of site deployment, and this time we will enable several sub-domains on our VPS server.

It is time to install a database management system. You are free to choose between MySQL and MariaDB. In this class, I will show you how to install MariaDB, which is my recommendation, but both will work and will be used exactly the same.

It is very possible that, over time, it is necessary to access MySQL or MariaDB to manage the databases. See how to get access to any of these from the console and, in the process, create some databases.

We already saw some security details, so it is time to secure the installation of MySQL or MariaDB, both in a similar way.

As a final security step, we will isolate each database accordingly, assigning a single user to each one.

It is time to install PHP, as an independent module of the system, so both the web server and PHP can work independently.

Let us take look at the most important PHP locations, along with the log file that can help us solve problems.

As usual, we will ensure the installation of PHP, so we have secured all sites that use PHP for its operation.

Since we have PHP and Nginx as completely independent modules, it is necessary to indicate Nginx where to send the requests for PHP files, so those are properly processed.

The .htaccess files, like the git files and folders, could give sensitive information to a possible attacker. By avoiding access to them, you will prevent putting any information at risk, without altering the possible operation of these systems.

By default, Nginx includes its version and the operating system in the response headers of each site. During this class, you will see how to prevent this from happening and avoid revealing important information.

By avoiding clickjacking, you prevent your sites from being included in external sites, through iFrames or similar. Therefore, you prevent your content from get used improperly and prevent your users from being deceived.

It prevents browsers from assuming the type of files they serve based on the content, but they rely only on the type of file itself. In this way, you avoid possible files, which are plain text, to be executed when detected as JavaScript or similar.

Avoid XSS in your sites so if you get injected executable code, the browser prevents it and blocks the execution of the site.

Improve the performance and bandwidth consumption of your sites by compressing the responses through Gzip.

Restrict a bit the limits of requests and simultaneous connections that a user can have with your system, in order to mitigate the impact of possible DoS and DDoS attacks.

It is time to ensure that any site that points to the IP of your server and is not part of your configured sites is redirected to your default site, instead of presenting the content. This may generate confusion in your users and open the doors to possible attacks and tricks.