Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Were recently going to start an ecommerence website that also stores Credit Card details and such. Our security is well on the software side, but with regards to the entire OS, we fall weak and are looking to sure our station. I came across a tool called webmin that helps you configure your linux box. How good is this tool and do you guys recommend this tool to be used to secure a website? For example i saw that the tool allows you to play with IPTables.

Is this a good tool to use to properly secure a website against any attacks. We have also ensured MySQL is secure following this tutorial http://www.securityfocus.com/infocus/1726

share|improve this question
6  
Unless you really know what you're getting into, do not store credit card information. It's a whole new bag of hurt, legally, and you will regret it if you don't take measures to pass the information to a company that actually handles credit card information securely. Otherwise you're going to eventually have the pleasure of dealing with possible identity theft issues when/if someone cracks your server. –  Bart Silverstrim Feb 25 '10 at 19:40
5  
If you can't configure a Linux server using cli tools then you shouldn't be storing credit card numbers. And you shouldn't be "playing" with anything on a machine storing credit card numbers. –  kaerast Feb 25 '10 at 19:47
    
To echo what others have said, avoid storing CC numbers. Talk with your processor to determine if other information can be used for chargebacks or validations. As an example first 4 and last 3 digits of the CC#. –  David Yu Feb 25 '10 at 22:53
add comment

2 Answers 2

up vote 3 down vote accepted

Webmin is a good tool, but it's also another potential security hole...Make sure you lock it down so it can only be accessed from trusted hosts.

It's basically a graphical front-end for a ton of command line stuff. It can't do anything that you can't do on a command line, but it makes some of those things a little more friendly...So if you already know how to secure a box, it'll help.

If you don't know, however, it's not going to change anything.

My advice is, unless you absolutely have to, do NOT store credit card details. Store the last four digits for verification, and pass the rest up to your merchant provider, and let them shoulder the burden.

When you step into the world of hardened credit card handling machines, you have to understand that you need to keep on top of that machine constantly because every new vulnerability will get tried against it at some point.

share|improve this answer
add comment

Have you audited for SQL Injection, XSS, CSRF, CRLF manipulation, buffer overflows, format string attacks....

The point is, You probably HAVEN'T secured your system, and its unlikely that you'll be able to without a security consultant.

Save yourself the hassle, let the CC processor handle it.

As for the actual question, Webmin is not a good tool to secure your website. I always recommend GreenSQL with Grsec/SELinux patch for webservers and a review of the use of stripslashes() or a similar function on any user-available content (Which is surprisingly small in Magento).

Which on that note, Magento has a fairly good security record, having said that, I'd only trust anyone else as far as I can throw them and user-made extensions ALWAYS open you up to new vulnerabilities which are not audited nearly as throughly as the original codebase.

The problematic component of website security in your particular scenario is that the game is over once any user is compromised (presumably you'll be running apache/nginx as nobody). This means that jail() can't save you now so you need to be extra diligent with your setup - You WILL be attacked, Mostly by Chinese and Russian script-kiddies, but you'll occasionally get an actual blackhat if you're processing enough cards.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.