The largest factor is the type of access the attacker has. If they have physical access, you're screwed. If you're only concerned with remote access then it depends what you have running; good configuration is everything. A standard linux server would probably be running ftp, ssh, http, https, and mysql. SSH is secure, but I wouldn't allow root logins, and a good password on every account is a must. FTP is hit or miss. If you have VSFTP and chroot your users, then it's very secure. Several other version have known vulnerabilities. HTTP is probably going to be your most vulnerable area. Your biggest concern here is anything that executes files on the system, or uploads files to the system. SQL injection is VERY hard if your website is done in PHP5. A group of security students and myself tried SQL injections on an unsanitized PHP5 website for weeks and were unsuccessful. With MySQL be sure to use a non-root user and restrict it to login only from your Apache server.
There's a couple Firefox plugins to test website vulnerabilities: access me, xss me, and sql inject me
Some big things I would always do at competitions to ensure security would be to run:
netstat
- check open ports and connections,
w
- who is logged in, how long,
- Check logs for logins,
- bash history for executed commands,
ps
- running commands,
/etc/passwd
for extra users
/etc/sudoers
for sudo access.
Typically after gaining access, an attacker wants to gain root. There are currently a few privilege escalation vulnerabilities out there that would allow a normal user to gain root. After that, they want to open it up for later access by adding users, and opening up back doors.
Here's my school's cyber defence website. Feel free to look around and ask some questions: https://thislink.doesntexist.org/