What's changed: Initial version (topic 1.10, subtopics 1.10.1–1.10.4)
5.4Cloud Security Basics
Learn what changes for Linux servers on public clouds: the division of responsibilities with on-premises (the management console, cloud-side firewalls, routing), the meaning of region selection (domestic/foreign constraints), ephemeral storage, provider-driven maintenance and reboots, and console access paths and authentication (multi-factor authentication, one-time passwords).
Inside the OS, a cloud Linux server works like on-premises—but everything outside the OS—power, the network front door, physical location—is held by the cloud provider. Understanding this "outside = provider, inside = you" split is the heart of this subtopic (a modern addition in Version 10.0).
5.4.1Division of functions and access paths
- The management console is the provider's web-based control plane: create/stop VMs, configure networking, and reach the system console—the last door when SSH is dead.
- Because the console is reached over the internet, harden its provider-supplied auth with multi-factor authentication (MFA) / one-time passwords (OTP). Leaked console credentials nullify all in-OS defenses—that account can delete every server.
- Network defense is two-layered: the cloud-side firewall (security groups, outside the instance) plus in-OS firewalld/iptables. Routing is likewise governed first by the virtual network.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.