Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to set up a safe and secure Web server

arstechnica.com

Post reply on HN
Print view View original

141–148 of 148 posts

Re: How to set up a safe and secure Web server

#141

Post by thedufer »

BigRedS wrote: post #74
thedufer wrote: post #39

Earlier quoted context omitted.

Honestly, its a much easier setup on your own box. You have the option of a GUI, and I've found installing a linux distro on my own box to be much easier than figuring out EC2.

I'm not sure where a GUI comes in handy here - it's not like there's any good GUI (in the traditional sense) tools for fiddling with webserver config. Even were I to want one on a webserver on the localhost I'd probably just install webmin or something, which you can do equally well on a VM somewhere else.

If you're not already comfortable with the command line, Ubuntu's package manager GUI is a hell of a lot more intuitive than apt-get. After that, a simple text editor is easier to work with than nano, emacs, vim, etc. for changing config files.

That said, I wouldn't use a GUI for such things, but I would still prefer my own box. The big power button is a lot easier than EC2s endless menus and options. I say this from the perspective of someone who's used EC2 for a couple of project - imagine someone who's never seen it before.

Re: How to set up a safe and secure Web server

#142

Post by ceol »

Stratoscope wrote: post #38
ceol wrote: post #16

Earlier quoted context omitted.

If you have a dynamic IP, Dyn offers DNS services[0] that let you tie a domain to it through them. I believe it requires you to install something on your machine that monitors your IP and reports it back. Otherwise, you just use your IP and make sure to edit the DNS yourself when it changes. [0]: http://dyn.com/dns/

Many routers have dynamic DNS support built in now. For example, my Asus RT-N66U supports several DDNS services including Dyn and a free one that Asus provides for its router customers at {yourcustomsubdomain}.asuscomm.com. No big surprise here, since the router is really just a nice little Linux box.

Ah, I have an Asus RT-N16. DD-WRT is truly awesome!

Re: How to set up a safe and secure Web server

#143

Post by laumars »

antihero wrote: post #136
laumars wrote: post #72

Earlier quoted context omitted.

I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as un…

How does this look? https://gist.github.com/c6fd22f73468b26e01b0 I built it from scratch (ish) so I know what all the parameters do. Do you have more info on the SSL PCI compliance?

comment out Include conf/extra/httpd-autoindex.conf (line 101), and as you're now no longer using it, it might also be worth taking out autoindex_module from your LoadModule's (saves a small bit of memory, but there wouldn't be any noticeable performance benefits. But as you're not using it, there's no point loading it).

For SSL PCI compliance, have the following config as part of your SSL settings (which you've got commented out currently):

  SSLHonorCipherOrder On
  SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
  SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
This should force Apache not to default to older insecure SSL protocols and disable SSL compression (HTTP compression via mod_deflate still works here) which leaves HTTPS open to attacks like BEAST.

Bare in mind I'm still testing the above code myself (funny enough, that's actually what I'm doing this very minute) as the BEAST vulnerability is still relatively new (or rather, new enough where it wasn't part of PCI compliance until the last month or so). I'll update this thread in the next few hours if that code doesn't work, but I can't see there being a problem as it follows the standards defined in Apache's manual.

Also make sure you have OpenSSL version 1.0.1 installed (required for TLS1.1 & 1.2). You can check this by running: openssl version from the command line. However if your system is built from a package manager and has been kept relatively up to day, then you shouldn't have a problem there.

Re: How to set up a safe and secure Web server

#145

Post by tzaman »

e12e wrote: post #125
tzaman wrote: post #53

This article would make a really nice screencast that would be much more useful to newbie sysadmins.

How would a screencast be more useful?

It's much easier to see the workflow and listen to someone speak, than read a complex article.

Re: How to set up a safe and secure Web server

#146

Post by e12e »

tzaman wrote: post #145
e12e wrote: post #125

Earlier quoted context omitted.

How would a screencast be more useful?

It's much easier to see the workflow and listen to someone speak, than read a complex article.

sounds like an argument for a simpler article. I agree, the article is rubbish.

Re: How to set up a safe and secure Web server

#147

Post by laumars »

laumars wrote: post #143
antihero wrote: post #136

Earlier quoted context omitted.

How does this look? https://gist.github.com/c6fd22f73468b26e01b0 I built it from scratch (ish) so I know what all the parameters do. Do you have more info on the SSL PCI compliance?

comment out Include conf/extra/httpd-autoindex.conf (line 101), and as you're now no longer using it, it might also be worth taking out autoindex_module from your LoadModule 's (saves a small bit of memory, but there wouldn't be any noticeable performance benefits. But as you're not using it, there's no point loading it). For SSL PCI compliance, have the following config as part of your SSL settings (which you've got…

OpenSSL 1.0.1 isn't required. but use the following SSLProtocol string instead:

  SSLProtocol ALL -SSLv2

Re: How to set up a safe and secure Web server

#148

Post by drudru11 »

e12e wrote: post #125
tzaman wrote: post #53

This article would make a really nice screencast that would be much more useful to newbie sysadmins.

How would a screencast be more useful?

not sure, but I wanted to say thanks for the C as a functional language links you replied with earlier. Comments are off after 14 days so I couldn't say thank you there. The closest was the function pointer one, but it still wasn't the one I remember.
Post reply on HN