Your SlideShare is downloading. ×
Checklist For Securing Linux Web Server In 10 Steps Or Less
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Checklist For Securing Linux Web Server In 10 Steps Or Less

2,980

Published on

This is a basic workbook for you to follow as a checklist. …

This is a basic workbook for you to follow as a checklist.


Learn the basic approaches to securing linux based web servers without getting too technical. This talk will be useful for anyone running a linux server with full root access.

You don't need to be an experienced system administrator to understand and use the content of this talk. But if you are a full time system admin you will get to know a structured way of looking at server security.

The following types of servers running Linux Virtual Private Server/Dedicated Server/Rackspace Cloud Instance/Amazon EC2

Not going to help if you have your website on Shared servers like Dreamhost/Go Daddy/Host Gator

Published in: Technology
1 Comment
1 Like
Statistics
Notes
No Downloads
Views
Total Views
2,980
On Slideshare
0
From Embeds
0
Number of Embeds
3
Actions
Shares
0
Downloads
80
Comments
1
Likes
1
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Feedback and comments @makash | akashmahajan@gmail.comSecuring Linux Web Server in 10 Steps or LessThis document is in addition to the slides of Securing Linux Web Server in 10 Steps or Less. Consider this asa starting block for Linux server hardening activities.Assumptions  You have root access to the Linux server  You are running either Ubuntu 10.04 LTS or above or a Debian variant. If you are using another distribution like CentOS etc. please understand the reasoning and substitute your commands.Checklist  Reduce the attack surface  Start with a mini distro and add software on top of it.  # tasksel install openssh-server  # tasksel install lamp-server  See which processes are listening on the external IP address  # netstat –nltup -4  Stop or remove services from running or booting up  # /etc/init.d/<service name> stop  # update-rc.d <service name> remove  Stop services from listening on external IP address  bind-address=127.0.0.1  Patch and Update your server  # apt-get update && apt-get upgrade  Secure your access with SSH  Remove Root Login  Ideally use public keys with passphrases  Add another directive in /etc/sshd_config  AllowUsers <user@host>  Secure Apache Web server  In /etc/apache2/conf.d/security  Uncomment line number 27 ServerTokens Prod  Uncomment line number 39 ServerSignature Off  Keep file owner as the user which uploads and group as www-data  Secure MySQL if database server and web server are on the same host  In /etc/mysql/my.cnf  bind-address=127.0.0.1  Execute following command  # mysql_secure_installation  Create a new user for each new database and only give access to the following  SELECT, INSERT, UPDATE, DELETE, ALTER, CREATE  Specify the host where the user can login from. Ideally this should be localhost and never ‘%’  Enable Uncomplicated Firewall  ufw allow  ufw allow <Ports you want>  ufw default deny  ufw allow from <external IP> to <current host IP> port 3306Workbook for http://slidesha.re/JMDS7F Page 1 of 1 ©Akash Mahajan 2012

×