Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). The problem is that I'm really very new to Linux in general, and I'm pretty broke so I can't afford a managed server.

I downloaded Ubuntu Lucid Server and have it running in a VirtualBox, to help me learn and to act as a close approximation to the eventual production server. I'm committed to learning, but I'm pretty afraid I'm going to miss something dumb and get compromised. As such, I'd like to know of any good guides/books explaining the main points of securing a LAMP server.

I've worked through the basic stuff in Linode and Slicehost's respective tutorials, but I want to be as prepared as possible. The site isn't written yet, and I'm likely to deploy to a shared host first as a trial run, so I do have time to learn at least the basics.

I know to keep everything up to date, configure iptables to only allow the holes I need (which appears to just TCP ports 22, for ssh/scp/sftp - I'll change it from the default port for the (very minor) security through obscurity bonus - and 80 for http) - though I am confused by some tutorials which say to block ICMP since I don't why I wouldn't want to respond to ping - and to only install software I need/remove software I don't need.

Any advice beyond this, and especially any recommendations for guides, are well appreciated.

share|improve this question

closed as primarily opinion-based by Ramesh, Patrick, mikeserv, Braiam, strugee Jun 13 at 23:44

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I personally think this question belongs on Server Fault. the AMP in LAMP should be offtopic here, IMO. –  xenoterracide Aug 22 '10 at 7:44
    
@xenoterracide: Fair enough, although I wasn't really looking for help with the AMP bits. You'll notice that the question title doesn't mention LAMP specifically - I asked about securing a server in general, which seemed pretty on-topic to me. I did mention the whole stack in the question, but I added it more as context than anything else. My real issue is that I'm a newb at Linux, and I thought the Linux SE would have the right expertise to help. BTW, I did ask this on SF previously, but I thought it would get more attention here, and I figured security info would be good to have here. –  AgentConundrum Aug 22 '10 at 10:11
    
well... my issue is like you said it's a question about server security in general. But it's not really my place to decide what's Ontopic here. –  xenoterracide Aug 22 '10 at 16:23
    
IMHO Use Debian instead of Ubuntu, run Nginx instead of Apache. The rest sounds good. Don't touch a shared host with a barge poll. –  Alex Chamberlain Oct 8 '12 at 10:40
add comment

4 Answers 4

Read the Gentoo Security Handbook. Most of it should apply to any Linux distribution.

share|improve this answer
add comment

As you're already using Ubuntu, I recommend their Server Guide, which offers a basic overview of a common set of default services.

Also have a look at Linux Server Security from O'Reilly. Actually, just search Amazon for quite a few offerings.

Googling server hardening checklist seems to return some good, practical, ways of quickly figuring out whether something's blatantly wrong with your setup.

Finally, head over to serverfault's security section and ask away.

Edit: also, ICMP should be blocked based on message. See ICMP Packet Filtering for details.

share|improve this answer
    
I saw the O'Reilly book earlier (via the same search you mentioned, actually), but was a bit put off by the publication date. Is a five year old book really still relevant today? I'll check out the rest of your links as well (well, except that I asked SF this question a while ago already, so there's no point in duplicating that effort). Thanks very much. –  AgentConundrum Aug 22 '10 at 6:26
add comment

Suggested reading from (mostly) authoritative and reputable U.S. sources:

You should also read the warnings in fineprint in your OS manuals.

share|improve this answer
add comment

Only a partial answer, but I've written an IPtables tutorial which may be of some use to you. http://www.ellipsix.net/geninfo/firewall/index.html

Besides IPtables, you'll need to configure SSH and Apache, but those come with default configurations that are sort of secure already, so there are only a couple things you'll probably have to change. Of course, as you add more features to your website, you'll have to keep the configuration up to date accordingly. Somebody else can probably recommend good references for that.

In fact, I'll make this community wiki so that if anyone else feels like adding in links, they can do so.

share|improve this answer
    
Thanks, I'll check out your site. I didn't realize that Apache, or especially SSH given what the S stands for, were insecure out of the box. Hopefully someone else can come along with a guide for them, if you have none. Thanks again! –  AgentConundrum Aug 22 '10 at 6:23
    
Well, the "Secure" in SSH only means that it sends your data in encrypted form, so that people can't snoop on an existing connection. But creating a secure SSH configuration is more about making sure that nobody can connect in the first place unless they're really authorized to do so. The encryption doesn't protect against that. –  David Z Aug 22 '10 at 21:46
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.