0

So as the title says I'm just deploying my first ever app in production.

Because I don't have experience, I was told to ask someone who knows this stuff.

So how should I ensure the best security for my VPS and for my app?

For now I did everything from this link (about node.js)

https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely

and from here about mongodb: https://docs.mongodb.com/manual/security/

For the VPS all I did was disable password auth, root auth and use RSA authentication.

I am also thinking about a firewall, but I don't really know what to use. Is 'ufw' sufficient?

Also, what ports should I block? I'm thinking about blocking everything instead of the one I'm running SSH and the one for hosting my Nodejs apps. Would that be okay?

Also, if I run my nodejs app on port 8080, can I also run MongoDB on that port too? Why would I want to run it on a different port and leave it open, when I can run it on 8080 too?

Sorry for the big list of questions but I have no one to ask about this stuff. I feel like this would be a good place to ask all of these things.

  • The question about security best practices is very broad. The questions about firewalls and ports are OK, but there is much more in securing an app that can't be answered in a single answer. – Sjoerd Jan 10 at 20:21
  • Try to give me a few tips or at least respond to the ones about fws and ports, please. :) – Andrei Daniel Jan 10 at 20:22
  • @AndreiDaniel - I would recommend that you try to ask your questions uniquely for each type of technology that you've selected. It would be possible to write a book on your question and not give enough information because you've asked for so much information. ---- Earnestly would like to communicate with you. Please see my profile for additional methods of communicating. Thanks. – Connor Peoples Jan 10 at 23:07
2

I recommend to have a bastion host to access your server via a SSH-port forwarding agent to tighten the SSH aspects.

Usually I perform OS hardening images using CIS Benchmark guide.

Always focus on 3-tier architecture concepts. I don't recommend to run on the same ports on the same node. You can use docker concepts for your usage.

I use the following:

  • Nginx for Reverse Proxy (Behind NAT or Direct Public IP) with SSL configuration and its respective encryption algorithms. (Port 80/443)
  • NodeJS for application tier (parsed from the Reverse Proxy's proxy-pass to custom port, similarity to 8080) using internal IP.
  • MongoDB connector (Mongoose) on another NodeJS application layer with different running port as middleware. (Port 8000)
  • MongoDB Server with custom port (you can also use the default port 27017) which only allow the TCP communications within the internal subnet of your docker containers.

Additionally, I don't use ufw. I use ConfigServer Security & Firewall (csf) for easier management for the server(s) since by default it is whitelisted (Deny) and on Test Mode to understand your usage.

Optional: You can use HAProxy as load balancer on top of Nginx and/or your application and db tier dockers.

1

Security is a practice. So, keep thinking and never assume you are safe, is a start.

So how should I ensure the best security for my VPS and for my app?

Indeed a very broad subject. Here is a start:-

  • Obviously following points(de facto)
    • SSL on frontend
    • remove unnecessary applications, especially the ones using network
    • change ssh port; these days you get tonne of scans and login attempts, if running ssh on port 22; firewall to your known IP address(es)
    • firewall using iptables or wraper ufw should be ok
    • disable root ssh login, and permit key login is ok. Can also consider 2FA google-authenticator pam.
    • use secure, httponly cookies
  • Only nginx is going to be listening on public interface, others on loopback(as I understand)
  • Consider using apparmor
  • Use several open source tools(arachni, sqlmap, xenotix, burp suite(freemium)/zaproxy etc) to audit your application for vulnerabilities

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.