Complete Server Security Checklist

This checklist provides a comprehensive review of security measures for your Data Mammoth server. Work through each section to ensure your infrastructure is properly hardened against common threats.

Account Security

• [ ] Enable 2FA on your Data Mammoth account. See Enable 2FA.
• [ ] Use a strong, unique password for your Data Mammoth account.
• [ ] Use a password manager to generate and store unique passwords for all services.
• [ ] Review account access — Remove any users or API keys that are no longer needed.
• [ ] Monitor the activity log for unauthorized actions. See Server Activity Log.

SSH Security

• [ ] Use SSH key authentication — Disable password-based SSH login. See SSH Key Best Practices.
• [ ] Use Ed25519 or RSA 4096-bit keys — Avoid older, weaker key types.
• [ ] Protect private keys with a passphrase.
• [ ] Disable root SSH login — Set PermitRootLogin no in /etc/ssh/sshd_config.
• [ ] Use a non-root user with sudo — See initial server setup guides.
• [ ] Limit SSH access — Use AllowUsers to restrict which users can SSH in.
• [ ] Change the SSH port (optional) — Use a non-standard port to reduce automated scans.
• [ ] Install Fail2ban — Block IPs after failed login attempts.
• [ ] Rotate SSH keys regularly — Every 6 to 12 months.

Firewall

• [ ] Enable a firewall — UFW (Ubuntu/Debian) or firewalld (CentOS/AlmaLinux). See Firewall Hardening Guide.
• [ ] Default deny incoming — Block all incoming traffic by default.
• [ ] Allow only necessary ports — SSH (22), HTTP (80), HTTPS (443), and application-specific ports.
• [ ] Block database ports externally — MySQL (3306), PostgreSQL (5432) should only accept local connections or specific IPs.
• [ ] Enable rate limiting on SSH — sudo ufw limit ssh.
• [ ] Review firewall rules periodically — Remove rules for services no longer running.

Operating System

• [ ] Keep the OS updated — Run regular updates. See initial setup guides.
• [ ] Enable automatic security updates — unattended-upgrades (Ubuntu/Debian) or dnf-automatic (CentOS/AlmaLinux).
• [ ] Disable unnecessary services — Stop and disable services you do not use.
• [ ] Set correct file permissions — Ensure sensitive files are not world-readable.
• [ ] Configure proper timezone — Set the correct timezone for accurate logs.
• [ ] Enable SELinux (CentOS/AlmaLinux) or AppArmor (Ubuntu) — Mandatory access control.

Web Server

• [ ] Install SSL/TLS certificates — Use HTTPS for all web traffic. See SSL/TLS Certificates.
• [ ] Redirect HTTP to HTTPS — Force all traffic through encrypted connections.
• [ ] Enable HSTS — Add Strict-Transport-Security header.
• [ ] Hide server version — Remove version information from HTTP headers.
• [ ] Disable directory listing — Prevent visitors from browsing file directories.
• [ ] Configure security headers — X-Content-Type-Options, X-Frame-Options, Content-Security-Policy.
• [ ] Limit request sizes — Prevent oversized uploads from consuming resources.

Database

• [ ] Use strong database passwords — Unique, complex passwords for all database users.
• [ ] Run the security script — mysql_secure_installation or equivalent.
• [ ] Restrict network access — Bind to 127.0.0.1 or specific IPs only.
• [ ] Remove default/test databases — Delete the test database and anonymous users.
• [ ] Use least-privilege database users — Each application should use a dedicated user with limited permissions.
• [ ] Enable query logging (for auditing) or disable (for performance) based on your needs.

Application Security

• [ ] Keep applications updated — WordPress, PHP, Node.js, Python, and all frameworks.
• [ ] Remove unused plugins and themes — Even deactivated ones can have vulnerabilities.
• [ ] Validate all user input — Protect against SQL injection, XSS, and other attacks.
• [ ] Use prepared statements for database queries.
• [ ] Store passwords with strong hashing — bcrypt, Argon2, or PBKDF2.
• [ ] Implement rate limiting on login forms and APIs.
• [ ] Set secure cookie flags — Secure, HttpOnly, SameSite.

Backup and Recovery

• [ ] Enable automated backups — Daily snapshots or application-level backups. See Backup Strategy.
• [ ] Store backups offsite — At least one copy in a different location.
• [ ] Test backup restoration — Verify backups can be restored successfully.
• [ ] Document the recovery process — Write down step-by-step restoration procedures.
• [ ] Protect backup files — Encrypt sensitive backups and restrict access.

Network Security

• [ ] Configure reverse DNS — Set PTR records for your server IP. See Server Networking.
• [ ] Enable DDoS protection — Activate enhanced protection for critical services. See DDoS Protection.
• [ ] Monitor network traffic — Watch for unusual patterns.
• [ ] Use VPN for sensitive connections — Encrypt management traffic between servers.

Monitoring and Logging

• [ ] Monitor server resources — CPU, RAM, disk, network. See Server Metrics.
• [ ] Centralize logs — Collect and review logs from web server, application, and system.
• [ ] Set up alerts — Notifications for resource thresholds and suspicious activity.
• [ ] Review logs regularly — Check for failed login attempts, error spikes, and unauthorized access.
• [ ] Retain logs — Keep logs for at least 30 days for incident investigation.

Regular Maintenance

• [ ] Weekly — Review monitoring alerts and resource usage.
• [ ] Monthly — Apply pending updates, review firewall rules, check backup status.
• [ ] Quarterly — Test backup restoration, rotate SSH keys, review access controls.
• [ ] Annually — Full security audit, update documentation, review compliance requirements.

What to Do Next

• Security at Data Mammoth — Our security practices.
• Enable 2FA — Start with account security.
• Server Firewall Hardening Guide — Lock down network access.
• Initial Server Setup — Ubuntu — Secure server from day one.