No doubt there is much good information at this link on hardening a linux server and at the child links off of that. And at this link to relevant tools it seems there has not yet been a popular security tool that the wiki writers are not enthusiastic about. Reading and understanding it all would take a considerable amount of time depending on the level of knowledge you are starting with and then more time on top to install and evaluate and learn to use a subset of the 15 or so tools and implement enhanced security. However, the volume and nature of the advice makes it seem to me that the advisers may have in mind the security of well-known sites with multiple logins (and users), dedicated IT security personnel, and a web-presence reputation and corporate reputation to protect.
What high priority steps should I take in much less time than it would take to research security on stackexchange and ubuntu.com (say, 30 minutes or less) to enhance the security of my certainly-not-well-known server? Details about my deployment and needs:
- one instance (on the linode cloud) running the desktop version of ubuntu 10.10 (Maverick) and no intention nor need to have more than one instance
- availability needs: one multi-hour outage per month is acceptable. If and when there is a DOS attack, it will be inconvenient to figure out how to avoid it happening again but probably no more than an inconvenience
- privacy need: yes, please
- one administrator, presently logging in as
- zero users, in the traditional sense. The administrator would be the only 'user' logging in to evolve the system and when it goes live, the administrator will be VNCing to look at results once or twice per day
- SSH, although I did nothing at the server to force the client to do this
- VNC. At the client I always use SSH for VNC, although I did nothing at the server to force the client to do this
- The system is mostly up and running but I will occassionally need to
purgeas I evolve the system I am developing
- Filezilla to evolve the system (example: send it a new version of the application). I always specify port 22 but I did nothing at the server to require this
- the server runs exactly one application in Java (and a little bash scripting) developed by a trusted person, although that application will link popular libraries (example: Java's Joda) or invoke popular utilities (example: gnome-terminal, linux beep utility 1). The application uses a trusted library to talk to the internet and the port number is known to me.
- the administrator is using a strong password