Only Install What You Absolutely Need

One of the easiest ways to keep your home server secure is to keep security in mind from the very beginning. This starts with installation. Are you unsure if you need an application or service? Don’t install it. You can always install it later. If you’ve installed Linux a few times, this is even easier. Instead of sticking with the defaults, use the modes that give you the most control over installation. Sometimes these are named “expert mode” or something similar. Carefully keeping track of install options can save you time disabling services for security reasons later.

Configure sudo

Before you move on to any other steps, you need to configure sudo. Why? Because once we’re done here, you’ll log into your server via SSH, and you won’t be able to log in as the root account. To make any further changes to your system, you’ll need to use sudo. First, check to see if you’re already able to use sudo. From your user account, run the following with your username instead of USERNAME: If you see a message displayed stating that your username can run “(ALL) ALL,” or something similar, you’re ready to move on. Now, as the root account on your server, run the following to edit the “/etc/sudoers” file. If you prefer another editor, use it instead of nano. Edit the file to include the following, with your username instead of USERNAME:

Configure SSH

You may already have SSH enabled on your home server. You likely do, in fact, as this is typically the way you interact with a server. First, make sure OpenSSH is installed. If you use another distribution, your command will vary, but the package name should be fairly consistent. On Ubuntu, run the following: Using key-based authentication is much more secure than password authentication, so we’ll set up SSH to work this way. To do this, make sure you’re working on a client you plan to connect to the server with, not the server itself. First, you want to make sure you don’t already have any SSH keys: If you see “id_rsa” and “id_rsa.pub” among the filenames listed, you already have SSH keys. Skip this next step. Now you’ll copy the SSH key to your server: For a home server, you may likely be using an IP address for your server instead of a name. If you don’t know your server name, use your IP address instead of SERVER above. Now we’ll edit your SSH settings to secure them more. Log into your server from the client on which you created the keys. This will enable you to log in again after this step.Run the following, replacing nano with the editor of your choice. Edit the file and with the following settings. These will be located in various places in the file. Make sure there are no duplicates, as only the first instance of a setting will be followed. Now you need to restart the SSH server with one of the following commands. On Ubuntu, run:

Configure a Firewall

Depending on the services you’re running and how much your server connects to the Internet, you may want to run a firewall. There are a few options for this, but the tried and true method on Linux is iptables. Setting up iptables is beyond the scope of this article, but don’t worry. We have a complete guide to configuring iptables on your machine. Another easier way to set up a firewall is to use ufw. You can install it with the command: By default, it will block all ports. To enable online and ssh access, run the following ufw commands to open up ports 80, 443, and 22: And lastly, enable the ufw service:

Stay Up to Date

Servers can be easy to forget about if they just work, but this can be dangerous. Make sure to keep your software up to date. You can use unattended upgrades, but these can be unpredictable. The safest way is to schedule a regular weekly or monthly server maintenance appointment to make sure everything is up to snuff.

Where to Go from Here

Now you have a good start to keep your server protected from outside threats. What if you need to access your server from home, though? Every door you open could potentially be used by an attacker, and every open port increases your vulnerability. One of the easiest ways to access your home network from outside is to use a VPN, which is outside the scope of this article, but don’t worry, we have you covered. Take a look at our list of the best secure VPN services available for an idea of what your options are.