Securing Your Droplet

Secure your DigitalOcean Droplet from malicious actors attempting to compromise your systems. This talk will cover the foundations of securing your droplet, protecting your users, and keeping your data safe.

This Talk is Designed For
- Anyone who is spinning up a Droplet on DigitalOcean

Agenda
00:00 Introduction
01:45 SSH keys
08:05 Firewalls
17:48 Virtual private clouds
26:36 Service auditing
30:09 Unattended updates
34:02 Backing up
37:21 SSL/TLS encryption
41:21 Isolated execution environments
45:39 Q&A

Resources

About the Presenter

#digitalocean #droplet #security

[timeakiss_]

Hey @masonegger and @digitalocean guys :) Thanks for these talks! This week there was Securing Your Deploy webinar where the presenter was talking about levels to approach security in order to implement a plan from the MVP level to full scalability. I found that approach very useful in defining priorities mapped to product maturity. It would be nice to have this red line run through other talks too (Level1, 2 and 3). Would love to learn more about password/secret management from the level to a fully setup scalable, rotated keys in vault level solution.
Great job on the content in video, tutorials, community building. Thank you once again.

[kaloyangeorgiev]

Great video, I have one quesiton tho. Are these firewall setups enough? Would we need something else regarding firewall?

[stefanvadev]

It was a great and very helpful talk! @masonegger, could you share which are the good practices for outbound firewall rules? Thanks!

[AkashSharma-idpv]

Hey, Thanks for video, I learned many new things!!
Can you please let me know, how to prevent files access? I have setup digital ocean server and point a domain name to it. It works good with domain name. But when I try with ip along with folder path, all files directly accessible (along with .env file). How can I enhance my server security to reduce these kind of risk?

[icalculi]

question about SSL, what is the difference between certbot and "paid" certificates from godaddy?

[CardinalHijack]

The SSH rule added after at 25:32 doesnt make sense to me - the inbound rule here allows SSH connections from source IP's in the VPC range, but to what? What machine(s) are now limited to inbound connections from our VPC? I dont see how this links to droplets in the VPC? Its like we should apply this rule to the VPC, but we dont.

As an example - if you wanted to only allow a specific IP to SSH into anything inside the VPC (for example, only allow SSHing into your VPC servers from your static business IP address), I dont see how adding the value at 25:32 appends this rule to the VPC. All this rule does is allow SSH connections from a source - it doesnt apply it to any machine or network though?