I want to run my own root server (directly accessible from the web without a hardware firewall) with debian lenny, apache2, php5, mysql, postfix MTA, sftp (based on ssh) and maybe dns server.
What measures/software would you recomend, and why, to secure this server down and minimalize the attack vector? Webapplications aside ...
This is what I have so far:
- iptables (for gen. packet filtering)
- fail2ban (brute force attack defense)
- ssh (chang default, port disable root access)
modsecurity - is really clumsy and a pain (any alternative here?)
?Sudo why should I use it? what is the advantage to normal user handling
- thinking about greensql for mysql www.greensql.net
- is tripwire worth looking at?
What am I missing? What is hot and what is not? Best practices?
I like "KISS" -> Keep it simple secure, I know it would be nice!
Thanks in advance ...