Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I want to run my own root server (directly accessible from the web without a hardware firewall) with debian lenny, apache2, php5, mysql, postfix MTA, sftp (based on ssh) and maybe dns server.

What measures/software would you recomend, and why, to secure this server down and minimalize the attack vector? Webapplications aside ...

This is what I have so far:

  • iptables (for gen. packet filtering)
  • fail2ban (brute force attack defense)
  • ssh (chang default, port disable root access)

  • modsecurity - is really clumsy and a pain (any alternative here?)

  • ?Sudo why should I use it? what is the advantage to normal user handling

  • thinking about greensql for mysql www.greensql.net
  • is tripwire worth looking at?
  • snort?

What am I missing? What is hot and what is not? Best practices?

I like "KISS" -> Keep it simple secure, I know it would be nice!

Thanks in advance ...

share|improve this question

migrated from stackoverflow.com Apr 14 '10 at 13:29

1 Answer

up vote 2 down vote

For ssh, you can use both password and keys, but for root it is a good idea to only permit the root login using a key based auth, which is handfull (I like ssh root@host).

share|improve this answer
Better not permit root logins via ssh, but prefer su/sudo. – Maxwell Apr 14 '10 at 14:24
Maxwell I am using su - to get my root access whats the difference between that and sudo? – mahatmanich Apr 14 '10 at 14:39
one, sudo can be configured to limit available commands that can be run. Two, sudo is logged when it's used. Three, it mitigates accidentally doing things that can damage the system, as you have to think slightly more before running privileged commands. – Bart Silverstrim Apr 14 '10 at 14:49
Thanks for the insights Bart ... I'll look into it! – mahatmanich Apr 14 '10 at 22:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.