Is this Ubuntu server configuration secure?

Question

I'm new to Linux and security matters. I have a vps with Ubuntu 12.04 server and I wonder how secure this server is.

I set up ssh passwordless login and disabled ssh login for root. I update security packages. I don't use a firewall. There are only two services which listen for external incoming connections:

~ > sudo netstat -tupln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1272/nginx
tcp        0      0 127.0.0.1:41333         0.0.0.0:*               LISTEN      1232/domain.lighttpd
tcp        0      0 127.0.0.1:4949          0.0.0.0:*               LISTEN      908/munin-node
tcp        0      0 0.0.0.0:21012           0.0.0.0:*               LISTEN      807/sshd
tcp6       0      0 :::21012                :::*                    LISTEN      807/sshd

Is my system secure? Is it worth to use a firewall to shield these two services?

Answer 1

Firewall does not shield services that need to be accessible from the network.

Is this a VM or a container VPS? If it's a container based VPS (done using OpenVZ or vserver), then you are quite limited in what you can do to improve security. If it's a VM, you can install a kernel patched with Grsecurity and use a MAC solution like TOMOYO, AppArmor or SELinux to isolate your services.

With passwordless login I presume you use keys? Also you need to learn more about the services you are running that are exposed to the network (nginx and ssh). Learn configuration files and what options you have.

Read man pages for config files. Certain configuration options (and combinations of) can lead to a vulnerable system.

Your system will always be insecure until you (admin) know your system, dangers and security mechanisms at your disposal.