Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

I have set up Apache, MySQL, PHP, SSH (which I use to connect to the VPS), Node.js, MongoDB and ProFTPd. Now, I want to have a firewall on the system, so that no one hacks the system. For instance, MongoDB is open for all on the default port unless I set it to secure mode and provide a password and so on. But it is recommended to have security mode off, and use a firewall to block requests on that port instead.

How would I set up the firewall? (I am not experienced with Linux, and I can only use SSH.)

share|improve this question
As a caution setting up a firewall on a remote system requires foresight. Or to put it the Shorewall way: Do not attempt to install Shorewall on a remote system. You are virtually assured to lock yourself out of that system. – lgarzo Jun 12 '12 at 10:39
@Igarzo Ok. So, I should really just set up a password on MongoDB, and make sure it is secure? – Friend of Kim Jun 12 '12 at 11:08
I believe you should secure your applications, because some security problems cannot be „cured” by using a firewall. Also you should set up a firewall, but make sure you have a way to access the system if something turns out to be wrong. These are just multiple layers of protection. – lgarzo Jun 12 '12 at 11:16
@Igarzo I don't know what to block. I could block everything except 80, 81, 22, 21 maybe. But is it insecure not to block ports that no programs on the server are listening to? – Friend of Kim Jun 12 '12 at 13:28
Your question is too vague. What does it mean "how to set up"? – poige Jun 12 '12 at 13:33
show 1 more comment

2 Answers

up vote 1 down vote

Any iptables tutorial should do the trick.

Positive security is best. Block everything and only allow the traffic you specify.

Layers of security is rarely a bad thing. MongoDB is famous for its insecurities, so I suspect secure mode is a good start.

What hosting provider are you using?

share|improve this answer
We're using a host in our country, so it is in a foreign language. But it is a VPS server. I've set up MongoDB with --auth and --ip_bind 127.0.0.1. Isn't this enough? I just need a specific command or more to do the job for me. I'm afraid that I lock myself out if I test tutorials... – Friend of Kim Jun 12 '12 at 17:20
Most VPS servers have a rescue mode, does yours? – Alex Chamberlain Jun 12 '12 at 17:27
up vote 0 down vote

Like the guy above, I would suggest iptables. Also if your up for another layer of security, which is always a good idea, take a look at snort. I am assuming that this is a home server type of setup. If I was you I would seperate my network so the webserver is in a DMZ. For instance My network would look something like this.

-----------
| internet |
------------______________________
   |        |_______                 |
   |               |                 |
------------- ------------  -------------
| web server| | LAN      |  |  VPN Pool |
------------- ------------  -------------

I would recommend doing something like this if what your doing is going to be in use for an extended period of time. I use a hardware Firebox x700 running pfsense. pfsense is much simpler to configure rules then iptables because of an existing gui. I also wrote a little tutorial on installing it on a x700, plus people in the forums are very helpful. If you have a spare box sitting around with 3 nic's you could imitate my network. The thing you have to realize when hosting stuff on your own is not just worrying about your web/db server, but your other, sometimes less updated, LAN computers.

share|improve this answer
Thanks for this extensive answer, but I'm using a VPS. – Friend of Kim Jun 12 '12 at 17:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.