13

I have a website idea I want to build and launch, and I'm thinking of getting a small VPS to host it (I like Linode for their price, and they seem to be widely recommended). I'm pretty broke so I can't afford a managed server.

I downloaded Ubuntu Lucid Server and have it running in a VirtualBox, to help me learn and to act as a close approximation to the eventual production server. I'm committed to learning, but I'm pretty afraid I'm going to miss something dumb and get compromised. As such, I'd like to know of any good guides/books explaining the main points of securing a LAMP server.

I've worked through the basic stuff in Linode and Slicehost's respective tutorials, but I want to be as prepared as possible. The site isn't written yet, and I'm likely to deploy to a shared host first as a trial run, so I do have time to learn at least the basics.

I know to keep everything up to date, configure iptables to only allow the holes I need (which appears to just TCP ports 22, for ssh/scp/sftp - I'll change it from the default port for the (very minor) security through obscurity bonus - and 80 for http) - though I am confused by some tutorials which say to block ICMP since I don't why I wouldn't want to respond to ping - and to only install software I need/remove software I don't need.

Improve this question
4
  • 1
    I personally think this question belongs on Server Fault. the AMP in LAMP should be offtopic here, IMO.
    – xenoterracide
    Aug 22, 2010 at 7:44
  • @xenoterracide: Fair enough, although I wasn't really looking for help with the AMP bits. You'll notice that the question title doesn't mention LAMP specifically - I asked about securing a server in general, which seemed pretty on-topic to me. I did mention the whole stack in the question, but I added it more as context than anything else. My real issue is that I'm a newb at Linux, and I thought the Linux SE would have the right expertise to help. BTW, I did ask this on SF previously, but I thought it would get more attention here, and I figured security info would be good to have here.
    – AgentConundrum
    Aug 22, 2010 at 10:11
  • well... my issue is like you said it's a question about server security in general. But it's not really my place to decide what's Ontopic here.
    – xenoterracide
    Aug 22, 2010 at 16:23
  • IMHO Use Debian instead of Ubuntu, run Nginx instead of Apache. The rest sounds good. Don't touch a shared host with a barge poll.
    – Alex Chamberlain
    Oct 8, 2012 at 10:40

4 Answers 4

Reset to default
8

Read the Gentoo Security Handbook. Most of it should apply to any Linux distribution.

Improve this answer
6

As you're already using Ubuntu, I recommend their Server Guide, which offers a basic overview of a common set of default services.

Also have a look at Linux Server Security from O'Reilly. Actually, just search Amazon for quite a few offerings.

Googling server hardening checklist seems to return some good, practical, ways of quickly figuring out whether something's blatantly wrong with your setup.

Finally, head over to serverfault's security section and ask away.

Edit: also, ICMP should be blocked based on message. See ICMP Packet Filtering for details.

Improve this answer
1
  • I saw the O'Reilly book earlier (via the same search you mentioned, actually), but was a bit put off by the publication date. Is a five year old book really still relevant today? I'll check out the rest of your links as well (well, except that I asked SF this question a while ago already, so there's no point in duplicating that effort). Thanks very much.
    – AgentConundrum
    Aug 22, 2010 at 6:26
5

Suggested reading from (mostly) authoritative and reputable U.S. sources:

You should also read the warnings in fineprint in your OS manuals.

Improve this answer
1

Only a partial answer, but I've written an IPtables tutorial which may be of some use to you. http://www.ellipsix.net/geninfo/firewall/index.html

Besides IPtables, you'll need to configure SSH and Apache, but those come with default configurations that are sort of secure already, so there are only a couple things you'll probably have to change. Of course, as you add more features to your website, you'll have to keep the configuration up to date accordingly. Somebody else can probably recommend good references for that.

In fact, I'll make this community wiki so that if anyone else feels like adding in links, they can do so.

Improve this answer
2
  • Thanks, I'll check out your site. I didn't realize that Apache, or especially SSH given what the S stands for, were insecure out of the box. Hopefully someone else can come along with a guide for them, if you have none. Thanks again!
    – AgentConundrum
    Aug 22, 2010 at 6:23
  • Well, the "Secure" in SSH only means that it sends your data in encrypted form, so that people can't snoop on an existing connection. But creating a secure SSH configuration is more about making sure that nobody can connect in the first place unless they're really authorized to do so. The encryption doesn't protect against that.
    – David Z
    Aug 22, 2010 at 21:46

Not the answer you're looking for? Browse other questions tagged .