Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I want to run my own root server (directly accessible from the web without a hardware firewall) with debian lenny, apache2, php5, mysql, postfix MTA, sftp (based on ssh) and maybe dns server.

What measures/software would you recomend, and why, to secure this server down and minimalize the attack vector? Webapplications aside ...

This is what I have so far:

  • iptables (for gen. packet filtering)
  • fail2ban (brute force attack defense)
  • ssh (chang default, port disable root access)
  • modsecurity - is really clumsy and a pain (any alternative here?)

  • ?Sudo why should I use it? what is the advantage to normal user handling

  • thinking about greensql for mysql
  • is tripwire worth looking at?
  • snort?

What am I missing? What is hot and what is not? Best practices?

I like "KISS" -> Keep it simple secure, I know it would be nice!

Thanks in advance ...

share|improve this question

migrated from Apr 14 '10 at 13:29

This question came from our site for professional and enthusiast programmers.

marked as duplicate by MadHatter, Iain, RobM, Jenny D, HopelessN00b Jun 18 '14 at 11:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

For ssh, you can use both password and keys, but for root it is a good idea to only permit the root login using a key based auth, which is handfull (I like ssh root@host).

share|improve this answer
Better not permit root logins via ssh, but prefer su/sudo. – Maxwell Apr 14 '10 at 14:24
Maxwell I am using su - to get my root access whats the difference between that and sudo? – mahatmanich Apr 14 '10 at 14:39
one, sudo can be configured to limit available commands that can be run. Two, sudo is logged when it's used. Three, it mitigates accidentally doing things that can damage the system, as you have to think slightly more before running privileged commands. – Bart Silverstrim Apr 14 '10 at 14:49
Thanks for the insights Bart ... I'll look into it! – mahatmanich Apr 14 '10 at 22:31

Do a port scan and leaves open only as needed. If you have IPv6 do not forget to check also. with you can check the IPv4 and IPv6 ports simultaneously.

share|improve this answer

By default: SSH - SSH Keys only, Root login allowed. IPTables - Deny all by default. Only 80/443 is opened to the public. fail2ban - Disabled. Too much overhead on busy web servers. modsecurity - Pain in the ass. Don't use.

I also have a VPN setup w/IPSec to allow me to access the servers when I am not in the office. Any/All computers I use which have any SSH keys are encrypted. You could steal my computer and not get any of the information needed to get access to any of the servers or my VPN. I am the only one with the root key. Others may have sudo access to specific commands. Anyone with any SSH Key is required to encrypt their OS/Data.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.