Securing a Newly Delivered Cloud Server: The First Steps

When you receive a cloud server, you usually get a public IP, a username and a password, and it’s tempting to install your software that same day. But a server with a public IP is found within its first few hours by bots that scan the internet for open ports and weak passwords. A few hours spent at the start prevents weeks of trouble later.

Who is responsible for security?

With most cloud server services, the provider is responsible for the hardware, power, data center network and virtualization platform; but security inside the operating system, meaning accounts, updates, software and open ports, is the customer’s responsibility, unless you have a managed service. Make it clear from day one which parts are yours.

First steps, in order

1. Change the initial password: The password you were sent is probably still sitting in an email or messaging app. Set a long, unique password right away.
2. Fully update the operating system: The initial OS image may be months old. Before anything else, install all security updates and restart the server.
3. Create a personal admin account: Instead of working with the default account, create a separate account for each administrator and disable or restrict the default accounts.
4. Restrict administrative access: Don’t leave the management port (RDP or SSH) open to the whole internet; allow only the office’s static IP or access through VPN.
5. Configure the firewall with a “deny all except what’s needed” approach: Only the ports the service actually needs should be open, for example 443 for a website.
6. Enable account lockout after failed attempts so that password guessing becomes practically impossible.

Changing the default RDP or SSH port reduces automated scanning, but it is no substitute for IP restrictions, VPN and strong passwords.

A firewall in two layers

If your provider offers a firewall or security group in its panel, use it alongside the operating system firewall. The external firewall stops unwanted traffic before it reaches the server, and if the OS firewall is accidentally turned off, the server is not left completely defenseless. After configuring it, check from a connection outside your network that only the intended ports are actually open.

Extra services and software

• Don’t install, or remove, roles, services and software you don’t need.
• Make services such as databases available only on the internal network or localhost, not on the public IP.
• Install suitable antivirus or endpoint protection for the operating system and keep it up to date.

Backup and monitoring from day one

Before moving real data, set up backups and test a restore once. A copy of the backup should live outside the server itself and, preferably, outside the same account in the provider’s panel. Keep login logging enabled and review failed logins periodically; a sudden increase is a sign the server is being targeted.

Checklist

• The initial password has been changed and personal accounts have been created.
• The operating system is fully up to date.
• The management port is reachable only from specific IPs or through VPN.
• Only the necessary ports are open, and this has been verified from outside.
• The database and internal services are not reachable on the public IP.
• An off-server backup is configured and tested.

A secure cloud server is built from day one, not after the first attack. ITPlus724 engineers can secure and prepare your cloud server before it goes into use, or review the configuration of your current server.