Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am recently running a web server, and there is a lot of information online, but it can all be a little confusing. I recently opened my logwatch logs and saw that i get attacked a lot by all sorts of bots.

Now I am interested in a list with things I definitely should be aware of nowadays, and possible ways to prevent them. I have read stories about server crashed by floods, crashed by email, and all sorts of crazy stuff.

Thing I already did:

  • I have recently blocked all my ports, except for the http and email ports.

  • I disabled IPv6, this was giving me a lot of named errors

  • I have turned on spam DNS blackhole lists to fight spam
    - sbl.spamhaus.org;
    - zen.spamhaus.org;
    - b.barracudacentral.org;

  • I installed and configured mod_security2 on apache

  • There is no remote access possible to my databases

That is all i did so far, further I am not aware of any other threats. I want to know if the following things have to be protects.

  • Can I be flooded by emails. How can i prevent this
  • Can there be a break in or flood of my databses
  • Are there things like http floods or whatever
  • Are there any other things i should know before i go public with my server

I also want to know if there is some kind of checklist with must-have security protections. I know the OWASP list for writing good web applications, is there something for configuring a server.

share|improve this question
1  
You might want to break these up into multiple questions. These are very open-ended topics that can't really be done justice here. –  Rugmonster Mar 24 '10 at 5:01
    
I will do that. –  Saif Bechan Mar 24 '10 at 5:26

3 Answers 3

up vote 3 down vote accepted

Can service X be flooded?

Yes. You have to ensure the services are configured such that if they do get flooded, your system's resources (CPU, memory, etc) won't be overcommitted. Since you're using mod_security, I assume you're running Apache and MySQL.

For Apache, you'll want to look at the average memory utilization for each Apache process. Adjust the MaxClients setting so that...

MaxClients * Average Memory Utilization < Total Physical Memory - System Overhead

If the DB service is on the same system, then you'll need to account for that. If you are using MySQL, a friend of mine wrote MySQLTuner. While certainly not a be-all-end-all, it will give you a starting point for adjusting your MySQL configs to fit your memory constraints.

With MySQL/Apache, you'll need to ensure you let those run at a normal load for a day or two so that memory utilization stabilizes to what you would consider a normal production level. You'll also need to monitor the system as time goes by as changes to your code and increases in traffic will have various effects in your resource utilization.

All of this is less security related as it is service availability related. In most cases, security isn't that hard. Keep your stuff patched, use good passwords, don't stress out. More times than not, it's going to be the brute force stuff that kills you and with proper resource planning, that can be mitigated to some extent.

share|improve this answer
    
Nice statements made. I will keep them in mind and read trough the tuner. –  Saif Bechan Mar 24 '10 at 5:19

I agree with Rugmonster, but, for some casual reading. ;)

http://msdn.microsoft.com/en-us/library/aa302351.aspx http://windows.stanford.edu/docs/IISsecchecklist.htm

share|improve this answer

I answered a similar question with some general security best practices here:

http://serverfault.com/questions/120345/secure-lamp-server-for-production-use/120354#120354

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.