How to set up a safe and secure Web server
arstechnica.com
How to set up a safe and secure Web server
1–10 of 148 posts
Re: How to set up a safe and secure Web server
#2It's also a good idea to install (and configure) at least some basic IDS like tripwire. You should probably have it do checks on a cron job
as well as doing chkrootkit.
Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them.
Also if you have multiple web apps running, chroot them if at all possible so that if something does break out it can't (so easily) wreak havok over your entire filesystem.
If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily.
I also didn't see mention of an update strategy for security updates. You can use apticron to email you with which updates are available and which are important for security.
You can set updates to go automatically (I recommend security only) but if you are more cautious you might want to test on a VM first. But keep an eye on them! This is very important, especially if you are managing wordpress etc through apt.
And so many other things that I have probably forgotten.
Having some form of audit (that tripwire can provide) is vital in those "oh fuck" moments where something doesn't seem quite right and you start wondering if you have been pwned but have no real way of actually knowing.
Re: How to set up a safe and secure Web server
#3For anyone that wants more resources like this, I've found articles in Linode's library to be very helpful: http://library.linode.com/lamp-guides
Re: How to set up a safe and secure Web server
#4It's also a good idea to install (and configure) at least some basic IDS like tripwire. You should probably have it do checks on a cron job as well as doing chkrootkit. Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them. Also if you have multiple web apps running, chroot them if at all possible so that if something does break o…
> If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily.
This is still a problem with shared hosting, where you might have multiple websites running on the same server. One shared host would be able to read another's sessions, because they are all running under the webserver's user. This[1] suggests overriding the session_set_save_handler and writing to a resource that only you control, such as your DB.
Re: How to set up a safe and secure Web server
#5I recently worked on a site run on such a server. I've set up my own servers before, and I think it can be fun, but this time it was the other guy's. I have to say it was pretty annoying because the little things that were not set up properly added up to a website that wouldn't deliver email, a shell environment with awful defaults...yuck. There was a lot of maintenance that was ignored because the guy just didn't have the time. Well, that's what commercial web hosts are for. It's amusing to think that some overburdened IT guys believe they're doing their clients a huge favor by running a vanilla web server in their network closet.
Re: How to set up a safe and secure Web server
#6[deleted]
Re: How to set up a safe and secure Web server
#7Frankly, articles like these are a deterrent to all but the most techie of people. Why go through all this and shell $270 when you can get an Amazon EC2 instance free for a year!
Re: How to set up a safe and secure Web server
#8Frankly, articles like these are a deterrent to all but the most techie of people. Why go through all this and shell $270 when you can get an Amazon EC2 instance free for a year!
Did you read the article? You still need to setup nginx or apache or whatever on EC2. Page 2 onwards actually deals with these things
Re: How to set up a safe and secure Web server
#9Frankly, articles like these are a deterrent to all but the most techie of people. Why go through all this and shell $270 when you can get an Amazon EC2 instance free for a year!
As far as being "the most techie of people", this article is actually quite basic and gives a very easy introduction.
Re: How to set up a safe and secure Web server
#10I think it's time articles like these start suggesting an infrastructure as code product, like chef or puppet, to do the heavy lifting.
I feel like doing this stuff by hand should be considered insecure and outdated..