danlefree's answer to this similar question is quite relevant here: How difficult is an unmanaged VPS?

Securing a server is more than just a one-off task.

Initial one-off tasks include:

• Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking one that came up from a search.
• Making sure unneeded services are turned off (or better, uninstalled).
• Make sure that services that do not need to be publicly available are not. For instance configure your database server to only listen on local interfaces and/or add firewall rules to block external connection attempts.
• Making sure that what-ever user(s) your web server processes (and other services) are running as have no read access to files/directories not relevant for them and no write to anything else unless they need write access to selected files/directories (to accept uploaded images for instance).
• Setup a good automated backup routine to keep online backups (preferably on another server or at home) so your content is copied elsewhere so you can recover it should the worst happen to the server (complete unrecoverable crash, or being hacked)
• Learn about all the tools that you have installed on your server (read documentation, perhaps install them on a test environment, say a local VM under virtualbox, to try out different configurations and break+fix them) so you have a chance of being able to fix issues if they occur (or at least properly diagnose such issues so you can help someone else fix the problem). You will thank yourself for the time spent on this at some point in the future!

Ongoing tasks include:

• Making sure security updates for your base OS are applied in a timely manner. Tools like apticron can be used to keep you informed of updates that need to be applied. I would avoid setups that automatically apply updates - you want to review what is about to change before you run (in the case of debian/ubuntu) aptitude safe-upgrade, so you know what is about to be done to your server.
• Make sure that updates to any libraries/apps/scripts you install manually (i.e. not from your distributions standard repositories using the built-in package management) are also installed in a timely manner. Such libs/apps/scripts may have their own mailing lists for announcement of updates, or you might just have to monitor their web sites regularly to keep yourself informed.
• Keeping informed about security issues that need to be fixed by configuration changes rather than patched packages or that need to be worked around until a patched package is created+tested+released. Subscribe to any security related mailing lists run by the people who maintain your distribution, and keep an eye on technology sites that may also report such issues.
• Managing some form of offline backup for extra paranoia. If you backup your server to a home machine, write a copy to CD/DVD/USB-stick on a regular basis.
• Testing your backups occasionally, so you know they are working correctly. An untested backup is not a good backup. You don't want to have your server die and then find out that your data has not been properly backed up for some months.

All good Linux distros install into a reasonably secure state out-of-the-box (at least after the first set of updates when you pull in the security patches that have been released since the install CD/image was pressed/released) so the job is not difficult, but it will take more time to do well than you might expect.

danlefree's answer to this similar question is quite relevant here: How difficult is an unmanaged VPS?

Securing a server is more than just a one-off task.

Initial one-off tasks include:

• Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking one that came up from a search.
• Making sure unneeded services are turned off (or better, uninstalled).
• Make sure that services that do not need to be publicly available are not. For instance configure your database server to only listen on local interfaces and/or add firewall rules to block external connection attempts.
• Making sure that what-ever user(s) your web server processes (and other services) are running as have no read access to files/directories not relevant for them and no write to anything else unless they need write access to selected files/directories (to accept uploaded images for instance).
• Setup a good automated backup routine to keep online backups (preferably on another server or at home) so your content is copied elsewhere so you can recover it should the worst happen to the server (complete unrecoverable crash, or being hacked)
• Learn about all the tools that you have installed on your server (read documentation, perhaps install them on a test environment, say a local VM under virtualbox, to try out different configurations and break+fix them) so you have a chance of being able to fix issues if they occur (or at least properly diagnose such issues so you can help someone else fix the problem). You will thank yourself for the time spent on this at some point in the future!

Ongoing tasks include:

• Making sure security updates for your base OS are applied in a timely manner. Tools like apticron can be used to keep you informed of updates that need to be applied. I would avoid setups that automatically apply updates - you want to review what is about to change before you run (in the case of debian/ubuntu) aptitude safe-upgrade, so you know what is about to be done to your server.
• Make sure that updates to any libraries/apps/scripts you install manually (i.e. not from your distributions standard repositories using the built-in package management) are also installed in a timely manner. Such libs/apps/scripts may have their own mailing lists for announcement of updates, or you might just have to monitor their web sites regularly to keep yourself informed.
• Keeping informed about security issues that need to be fixed by configuration changes rather than patched packages or that need to be worked around until a patched package is created+tested+released. Subscribe to any security related mailing lists run by the people who maintain your distribution, and keep an eye on technology sites that may also report such issues.
• Managing some form of offline backup for extra paranoia. If you backup your server to a home machine, write a copy to CD/DVD/USB-stick on a regular basis.
• Testing your backups occasionally, so you know they are working correctly. An untested backup is not a good backup. You don't want to have your server die and then find out that your data has not been properly backed up for some months.

All good Linux distros install into a reasonably secure state out-of-the-box (at least after the first set of updates when you pull in the security patches that have been released since the install CD/image was pressed/released) so the job is not difficult, but it will take more time to do well than you might expect.

danlefree's answer to this similar question is quite relevant here: How difficult is an unmanaged VPS?

Securing a server is more than just a one-off task. Initial one-off tasks include:

• Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking one that came up from a search.
• Making sure unneeded services are turned off (or better, uninstalled).
• Make sure that services that do not need to be publicly available are not. For instance configure your database server to only listen on local interfaces and/or add firewall rules to block external connection attempts.
• Making sure that what-ever user(s) your web server processes (and other services) are running as have no read access to files/directories not relevant for them and no write to anything else unless they need write access to selected files/directories (to accept uploaded images for instance).
• Setup a good automated backup routine to keep online backups (preferably on another server or at home) so your content is copied elsewhere so you can recover it should the worst happen to the server (complete unrecoverable crash, or being hacked)
• Learn about all the tools that you have installed on your server, so you have a chance of being able to fix issues if they occur (or at least properly diagnose such issues so you can help someone else fix the problem). You will thank yourself for this at some point in the future!

Ongoing tasks include:

• Making sure security updates for your base OS are applied in a timely manner. Tools like apticron can be used to keep you informed of updates that need to be applied. I would avoid setups that automatically apply updates - you want to review what is about to change before you run (in the case of debian/ubuntu) aptitude safe-upgrade, so you know what is about to be done to your server.
• Make sure that updates to any libraries/apps/scripts you install manually (i.e. not from your distributions standard repositories using the built-in package management) are also installed in a timely manner. Such libs/apps/scripts may have their own mailing lists for announcement of updates, or you might just have to monitor their web sites regularly to keep yourself informed.
• Keeping informed about security issues that need to be fixed by configuration changes rather than patched packages or that need to be worked around until a patched package is created+tested+released. Subscribe to any security related mailing lists run by the people who maintain your distribution, and keep an eye on technology sites that may also report such issues.
• Managing some form of offline backup for extra paranoia. If you backup your server to a home machine, write a copy to CD/DVD/USB-stick on a regular basis.
• Testing your backups occasionally, so you know they are working correctly. An untested backup is not a good backup. You don't want to have your server die and then find out that your data has not been properly backed up for some months.

All good Linux distros install into a reasonably secure state out-of-the-box (at least after the first set of updates when you pull in the security patches that have been released since the install CD/image was pressed/released) so the job is not difficult, but it will take more time to do well than you might expect.

danlefree's answer to this similar question is quite relevant here: How difficult is an unmanaged VPS?

Securing a server is more than just a one-off task. 

Initial one-off tasks include:

• Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking one that came up from a search.
• Making sure unneeded services are turned off (or better, uninstalled).
• Make sure that services that do not need to be publicly available are not. For instance configure your database server to only listen on local interfaces and/or add firewall rules to block external connection attempts.
• Making sure that what-ever user(s) your web server processes (and other services) are running as have no read access to files/directories not relevant for them and no write to anything else unless they need write access to selected files/directories (to accept uploaded images for instance).
• Setup a good automated backup routine to keep online backups (preferably on another server or at home) so your content is copied elsewhere so you can recover it should the worst happen to the server (complete unrecoverable crash, or being hacked)
• Learn about all the tools that you have installed on your server (read documentation, perhaps install them on a test environment, say a local VM under virtualbox, to try out different configurations and break+fix them) so you have a chance of being able to fix issues if they occur (or at least properly diagnose such issues so you can help someone else fix the problem). You will thank yourself for the time spent on this at some point in the future!

Ongoing tasks include:

• Making sure security updates for your base OS are applied in a timely manner. Tools like apticron can be used to keep you informed of updates that need to be applied. I would avoid setups that automatically apply updates - you want to review what is about to change before you run (in the case of debian/ubuntu) aptitude safe-upgrade, so you know what is about to be done to your server.
• Make sure that updates to any libraries/apps/scripts you install manually (i.e. not from your distributions standard repositories using the built-in package management) are also installed in a timely manner. Such libs/apps/scripts may have their own mailing lists for announcement of updates, or you might just have to monitor their web sites regularly to keep yourself informed.
• Keeping informed about security issues that need to be fixed by configuration changes rather than patched packages or that need to be worked around until a patched package is created+tested+released. Subscribe to any security related mailing lists run by the people who maintain your distribution, and keep an eye on technology sites that may also report such issues.
• Managing some form of offline backup for extra paranoia. If you backup your server to a home machine, write a copy to CD/DVD/USB-stick on a regular basis.
• Testing your backups occasionally, so you know they are working correctly. An untested backup is not a good backup. You don't want to have your server die and then find out that your data has not been properly backed up for some months.

All good Linux distros install into a reasonably secure state out-of-the-box (at least after the first set of updates when you pull in the security patches that have been released since the install CD/image was pressed/released) so the job is not difficult, but it will take more time to do well than you might expect.