Simplest Security Best Practices (for servers hosting Ruby on Rails apps)

Photo of Marcin Stecki

Marcin Stecki

Updated Aug 3, 2023 • 3 min read

A few simple practices you can apply that will take your software towards the goal of bulletproof-security.

The subject of security will be everlasting, as long as the internet and people exist. Security will never be satisfied; after all security is a learning, changing, fluid process. There are however, a few simple practices you can apply that will take you towards the goal of bulletproof-security. This is not a complete list, but something to get you started.

Servers hosting Ruby on Rails applications:

  • use encrypted backups of every database to an external service (e.g. Tarsnap)
  • host your user-generated content somewhere in the cloud (e.g. Amazon S3)
  • use unattended upgrades - (or a similar tool for your system)
  • lock all traffic with iptables and whitelist those you want to expose (e.g. just port 22, 80 and 443)
  • whitelist ips that can log in using ssh
  • use ssh with rsa keys (no passwords!)
  • disable root login
  • whitelist ips that can connect to your database (for single instance servers listen
  • always use ssl-only to serve a website
  • use fail2ban (or similar tools) to avoid ddos attacks on basic level
  • use monit to check disks, cpu and memory usage
  • monitor your app uptime with services like pingdom
  • use tools like PagerDuty in combination with monit and pingdom for automated event escalation

Other best practices for reference:

App codebase:

  • use automatic security issue detection (static code analysis; e.g. CodeClimate)
  • regularly review from devs not related to project (3rd person perspective)
  • upgrade libraries regularly (bundle update every now and then; CodeClimate watches your Gemfile for vulnerabilities in gems too!)
  • order pen tests every few months (preferably from an external company)

In reality, this list should be 3 times longer and include multiple solutions. Those are, however, the simplest things we chose to get you going. Let us know in comments if you think this basic list is missing something!

Photo of Marcin Stecki

More posts by this author

Marcin Stecki

What he really likes is the moment of satisfaction after solving a difficult problem. But quickly...
How to build products fast?  We've just answered the question in our Digital Acceleration Editorial  Sign up to get access

We're Netguru!

At Netguru we specialize in designing, building, shipping and scaling beautiful, usable products with blazing-fast efficiency

Let's talk business!

Trusted by: