Setup guide

Security Checklist

Tick every box before screens go live. A signage server facing the internet is a server like any other, and a hacked screen in a lobby is a very public embarrassment.

Server

  • Security updates install automatically (unattended-upgrades enabled)
  • SSH accepts keys only; password and root login disabled
  • SSH reachable only from the office LAN or VPN, never from the internet
  • Firewall (ufw) on; only 443 and 80 open to the outside
  • Admin page restricted to office and VPN address ranges
  • Every admin has their own login; no shared accounts; strong passwords
  • Default admin from the installer renamed or removed
  • Nightly backup running, stored off the server, restore tested once
  • Server on a UPS

Network

  • Edge firewall forwards only TCP 443 and 80 to the server, nothing else
  • Server can’t initiate connections into office or guest networks
  • Players on their own VLAN or SSID, separate from guest Wi-Fi
  • Guests can’t reach players or the server’s admin page
  • Split DNS in place so on-site players stay on the LAN
  • Certificate valid from inside and outside; SSL Labs grade A

Players

  • BIOS password set; USB boot disabled
  • No desktop, no keyboard attached in public areas
  • Physically secured: inside a locked enclosure, behind the TV, or in a ceiling
  • Unused players removed from the admin page so their tokens stop working
  • Each player labeled with its name

Accounts and records

  • DNS provider and registrar accounts use two-factor authentication
  • License key, admin logins and network notes stored in the property’s password manager
  • A one-page network sketch (like the diagram in guide 2) kept in the network room