Project description
TranslatedProtecting production servers is not a one-time task, but a systematic process requiring methodical closure of each attack vector. Our three VPS on Ubuntu 22.04 host PHP applications, MySQL databases, and Nginx — a standard LEMP stack, but with insufficiently closed attack surface. Based on internal review findings: SSH is available on standard port with password authentication, firewall rules are minimal, automatic brute-force protection is absent, and SSL certificates are renewed manually.
We need a DevOps engineer with production Linux experience who can conduct a complete audit and implement all hardening measures in a documented manner. Every change must be tested on running applications before being applied to production, and all documentation must be detailed enough for the team to understand what was done and why. The result should include a PDF security report with all identified vulnerabilities, implemented measures and residual risks, as well as configured monitoring with alerts.
Scope of work:
— SSH hardening: keys only, non-standard port, fail2ban
— UFW/iptables rules with documentation
— Fail2ban for SSH, Nginx and PHP-FPM
— Let's Encrypt with automatic renewal
— Nginx hardening: security headers, TLS 1.2+, HSTS, CSP
— MySQL audit and hardening: privileges, bind-address, encryption
— Logwatch and anomalous activity alerting
— ClamAV and rootkit scanner
— Health monitoring via cron with notifications
Result: applied changes with documentation, PDF report, monitoring dashboard.
We need a DevOps engineer with production Linux experience who can conduct a complete audit and implement all hardening measures in a documented manner. Every change must be tested on running applications before being applied to production, and all documentation must be detailed enough for the team to understand what was done and why. The result should include a PDF security report with all identified vulnerabilities, implemented measures and residual risks, as well as configured monitoring with alerts.
Scope of work:
— SSH hardening: keys only, non-standard port, fail2ban
— UFW/iptables rules with documentation
— Fail2ban for SSH, Nginx and PHP-FPM
— Let's Encrypt with automatic renewal
— Nginx hardening: security headers, TLS 1.2+, HSTS, CSP
— MySQL audit and hardening: privileges, bind-address, encryption
— Logwatch and anomalous activity alerting
— ClamAV and rootkit scanner
— Health monitoring via cron with notifications
Result: applied changes with documentation, PDF report, monitoring dashboard.
Administration Cash, Bank transfer
