GDPR-Compliant Server Hardening: Virtualmin against DDoS & Brute-Force Attacks for Association Websites

Why Association Websites Are a Popular Target

Association websites store sensitive data such as member lists, bank details, or personal emails. This information is exactly what makes them interesting to attackers. Without adequate protection, DDoS attacks can take the website offline, and brute-force attacks attempt to crack access credentials. The GDPR requires you as the operator to take appropriate technical measures to protect this data. With your own server and Virtualmin, you have full control – and can effectively secure yourself without relying on external cloud services.

Basics: Securely Configuring a Virtualmin Server

Before dealing with specific attacks, you should check the basic security of your server. This includes regular updates, using SSH keys instead of passwords, and configuring a firewall. Virtualmin offers a user-friendly interface for this, but the command line is also your friend.

1. Set Up a Firewall with UFW or iptables

A firewall is your first line of defense. With UFW (Uncomplicated Firewall), you can quickly define rules. Only allow necessary ports such as 22 (SSH), 80 (HTTP), and 443 (HTTPS). Block all other incoming connections. Example:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Additionally, you can use Fail2ban to detect brute-force attacks on SSH and web services and automatically block IPs.

2. SSH Hardening

Instead of passwords, you should use SSH keys. Disable password login in the file /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin no

Also change the default port from 22 to a higher port to reduce automated attacks. Remember to adjust the firewall accordingly.

DDoS Protection Without Cloud Services

DDoS attacks aim to flood your server with requests. Without external services, you need to counteract at the server level. Here are effective methods:

1. Rate Limiting with mod_evasive (Apache) or ngx_http_limit_req_module (Nginx)

Limit the number of requests per IP and time window. For Apache, install mod_evasive and configure it in the VirtualHost file:

<IfModule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
</IfModule>

With Nginx, use the limit_req module to limit requests per second.

2. IPTables Rules Against SYN Floods

A SYN flood is a common form of DDoS. With iptables, you can limit the number of SYN packets per second:

sudo iptables -A INPUT -p tcp --syn -m limit --limit 5/s -j ACCEPT
sudo iptables -A INPUT -p tcp --syn -j DROP

This rule allows only 5 new connections per second and drops the rest. Adjust the value to your needs.

3. Protection Against HTTP Floods with Fail2ban

Fail2ban can also help against HTTP floods by blocking IPs that send too many requests. Create a filter file for your web server and monitor the logs.

Brute-Force Protection for Web Applications and Email

Brute-force attacks target login pages, email accounts, and other access points. Virtualmin offers you several starting points:

1. Fail2ban for Virtualmin and Webmin

Configure Fail2ban to also monitor the logs of Virtualmin and Webmin. This way, IPs that repeatedly enter incorrect passwords are automatically blocked.

2. Enable Two-Factor Authentication (2FA)

For Webmin and Virtualmin, you can set up 2FA. This significantly increases security, even if a password is stolen.

3. Protect Email Passwords

Use strong passwords for email accounts and, if applicable, enable the rate-limiting function of Dovecot or Postfix to make automated attacks more difficult.

GDPR-Compliant Logging and Monitoring Strategy

The GDPR requires that you do not store logs longer than necessary. Therefore, set up rotation-based log management that automatically deletes logs after a certain time. Also, ensure that logs do not contain personal data or that it is pseudonymized.

1. Configure Logrotate

Logrotate is pre-installed on most distributions. Adjust the configuration to rotate logs daily and delete them after 30 days. Example for a file under /etc/logrotate.d/:

/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 640 www-data adm
    sharedscripts
    postrotate
        systemctl reload nginx
    endscript
}

2. Central Monitoring with a Dashboard

Use tools like Netdata or Glances to keep an eye on server load and suspicious activities. These run locally and do not require a cloud connection.

Backups and Recovery as Part of the Security Strategy

Even with the best protective measures, an attack can be successful. Therefore, regular backups are essential. Virtualmin offers integrated backup functions that you can store on an external storage or another internal drive. Ensure that the backups are encrypted to meet GDPR requirements.

Backup Strategy

Plan daily backups of the databases and weekly full backups. Test the recovery regularly to be able to react quickly in an emergency.

Conclusion: Security Begins with the Right Configuration

Securing your Virtualmin server against DDoS and brute-force attacks is an ongoing task. With the measures presented here – firewall, rate limiting, Fail2ban, 2FA, and a well-thought-out log strategy – you create a solid foundation that meets GDPR requirements. And all without external cloud services, giving you full control over your data.

If you need support setting up your server or are looking for a reliable hosting environment, check out our Webhosting offers. For the right domain, you will also find a large selection with us – visit our Domain page.