> ## Content Index
> Fetch the complete content index at: https://blog.jsinh.in/llms.txt
> Use this file to discover other available public pages before exploring further.

# Installing Ghost on Ubuntu, Nignx and MySQL - Part 2
- URL: https://blog.jsinh.in/installing-ghost-on-ubuntu-nignx-and-mysql-part-2/
- Published: 2014-05-12T05:44:00.000Z
- Updated: 2026-07-07T15:13:17.000Z
- Author: Jsinh
- Tags: #Import 2026-10-04 19:16

In continuation of [Installing Ghost on Ubuntu, Nignx and MySQL - Part 1](https://blog.jsinh.in/installing-ghost-on-ubuntu-nignx-and-mysql-part-1)

Now that you have secured your SSH connections, it is time to put up a firewall to secure all inbound network traffic.

#### Configuring UFW

Step: Install UFW ([Uncomplicated firewall](https://help.ubuntu.com/community/UFW?ref=blog.jsinh.in) \- not complicated at all, promise)

```
sudo apt-get update
sudo apt-get install ufw

```

Step: Add rules to allow inbound SSH (custom we configured previously) and HTTP (on port 80) traffic.

```
sudo ufw allow http
sudo ufw allow <your custom SSH port configured previously>

```

Step: Enable UFW and check status

```
sudo ufw enable
sudo ufw status verbose

```

You can check if your firewall is blocking other ports except SSH custom port and HTTP 80 using [PortQryUI](https://www.microsoft.com/en-in/download/details.aspx?id=24009&ref=blog.jsinh.in) on windows or just telnet on windows using Telnet client feature or linux `sudo apt-get install telnet` (just to be sure).

Also you can disable serving ping request (ICMP) on your droplet by

```
sudo nano /etc/ufw/before.rules

```

find the following lines

```
# ok icmp codes
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

```

comment the following lines and save the file (Ctrl + x > Y > Enter).

**Note:** I had some issue related to not finding IP Tables while setting up UFW on Ubuntu 12.10 x64 in DigitalOcean droplet.

[Few resolution](https://www.digitalocean.com/community/questions/problem-with-iptables?ref=blog.jsinh.in) [if you find yourself](https://www.digitalocean.com/community/questions/problem-with-iptables-and-ubuntu-ubuntu-13-10?ref=blog.jsinh.in) [facing similar situation](https://www.digitalocean.com/community/articles/how-to-set-up-a-firewall-using-ip-tables-on-ubuntu-12-04?ref=blog.jsinh.in).

#### Secure shared memory (Optional)

Step: Shared memory can be used in an attack against a running service (like Nignx in our case, I guess o.O)

```
sudo nano /etc/fstab

```

Go to to end of file and add the following line:

```
none	/run/shm	tmpfs	rw,noexec,nosuid,nodev	0	0

```

This will mount /run/shm writable, but without permission to execute programs, without permission to change the UID of running programs, or to create block or character devices in the namespace.

Step: Reboot your droplet so that following changes can take effect or remount /run/shm using following command:

```
sudo reboot
OR
sudo mount -o remount /run/shm

```

**Note:** You can skip this step if you are not completely sure or you get stuck due to this.

#### No SU for non-admin users

Step: Stop / deny `su` access to non-admin user, use following command:

```
sudo groupadd admin
sudo usermod -a -G admin <admin username / demoghost>
sudo dpkg-statoverride --update --add root admin 4750 /bin/su

```

#### Secure your network configuration with `sysctl` settings (Optional)

Step: Go to `/etc/sysctl.d` if directory exist and find file `10-network-security.conf` if yes print output of this file:

```
cat /etc/sysctl.d/10-network-security.conf

```

Find below three lines:

```
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.tcp_syncookies=1

```

Note: Ordering doesn't matter.

If above three lines are present in `10-network-security.conf` then remove the same from below *block of code*.

Step: Open `sysctl` configuration

```
sudo nano /etc/sysctl.conf

```

Step: Remove any existing content (except the one that refer to Digialocean settings) and paste following *block of code*

```
# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0 
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Log Martians
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1

```

Step: Save the changes (Ctrl + x > Y > Enter) and reload `sysctl` so this changes can take effect

```
sudo sysctl -p

```

#### Prevent IP Spoofing

Step: Edit host configuration

```
sudo nano /etc/host.conf

```

Step: Add if line does not exist or edit as below if already present

```
order bind,hosts
nospoof on

```

Now this droplet has few basic security measures taken care of.

Proceed to [Part 3 of Installing Ghost on Ubuntu, Nignx and MySQL](https://blog.jsinh.in/installing-ghost-on-ubuntu-nignx-and-mysql-part-3)