# Securing an unmanaged server

> Lock down a server you manage yourself with strong passwords, updates, a firewall and other essential security steps.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/securing-an-unmanaged-server/

Unmanaged servers give you **full root access** and complete flexibility to install, configure, and run whatever you want. With this freedom comes responsibility: you must secure the server yourself to prevent malicious attacks and data loss.

## Why Security Matters

- A minor attack can be disruptive, while a major one could wipe out your entire configuration and data.
- Without proactive security, unmanaged servers are vulnerable to spam, phishing, and hacking attempts.
- Securing your server ensures reliability, compliance, and customer trust.

## Recommended Security Steps

### 1. Use Strong Passwords

- Weak passwords undermine even the most carefully configured server.
- Always create **long, complex, and unique** passwords.

### 2. Disable Root SSH Access

- The root account is all‑powerful.
- Create a normal user account and disable direct root SSH login.
- This reduces the risk of brute‑force attacks targeting root.

### 3. Update the Server Regularly

- Security vulnerabilities are constantly discovered and patched.
- Example: the **Heartbleed OpenSSL vulnerability** (April 2014) highlighted the importance of updates.
- Keep your server up‑to‑date with the latest patches and fixes.

### 4. Set Up a Firewall

- Firewalls control incoming and outgoing network packets.
- Example rules:

  - Block all incoming packets on port 25.
  - Block outgoing packets to specific hosts or ports.
- Tools:

  - `iptables`
  - Advanced Policy Firewall (APF)

### 5. Configure Fail2ban

- **Fail2ban** monitors log files for suspicious activity.
- After a set number of failed login attempts, it automatically blocks the offending IP.
- This protects against brute‑force and unauthorized access attempts.

> **Note:**
- You must have **root access** to follow these procedures.
- Security is an ongoing process not a one‑time setup.
- Combine multiple layers of defense (passwords, firewall, monitoring) for maximum protection.