Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a classifieds website, which uses php5 and mysql, and also java (solr).

I am new to linux and VPS...

I have installed SSH, and I have installed IPtables, and also I have PuTTY which I use as a terminal. Also, Filezilla is installed on my computer, and whenever I connect to my VPS, the "host" field in Filezilla says "Sftp://ip-adress" so I am guessing it is a safe connection.

I used this command to find out if I had SSHD installed:

  whereis sshd

and it returned some places where it actually was installed. So I havent actually installed it.

Now, my Q is, is this enough?

What other security measures should I take?

Any good articles about security and how to set it up on a VPS?

Remember, I have a windows xp OS on my laptop, but the OS for my VPS is Ubuntu 9.10.

Also, I have apache2 installed...

Thanks

share|improve this question

2 Answers 2

Just plain installation of IPtables is not enough. You have to setup your firewall, and that means you have to learn how firewall works. There is lot of guides and howtos about setting firewall and basic security tips on the internet.

Same thing with SSH. Plain installation will allow you remote connection to server, but also it's recommended to make postinstallation setup. For example disable login for root user, allow connection only from specific IP address(es), etc.

If your website exchanges confindetial information with users, HTTPS is also thing for consideration.

This question is very general..

Regards,

Martin

share|improve this answer
    
the part about only allowing specific ip-adresses, do you mean to only allow specific ip:s to visit my website, or to login? I will look into the others. thanks. –  Anonymous12345 May 27 '10 at 7:58
    
If your website is meant for the whole world, it's not a good idea to filter IPs for tcp/80 ;-) However, filtering IPs for SSH is a good way of securing it. –  ℝaphink May 27 '10 at 8:13
    
iptables is fairly low level, and can be quite complicated. Ubuntu has a higher-level tool for configuring the firewall called UFW. Documentation is at: help.ubuntu.com/10.04/serverguide/C/firewall.html –  Shtééf May 27 '10 at 8:27
    
Of course I meant allowing access from specific IPs only for SSH, that's why this note was in paragraph about SSH;) –  mkudlacek May 27 '10 at 8:32

Installing secure programs on a server is good, but it's pointless unless you configure them securely.

For example, you have iptables, which provides an interface to Linux's firewall. This is good, but unless you actually have firewall rules, it's like you don't have a firewall at all, so I invite you to read about configuring iptables.

Then you have SSH, which lets you connect through sftp with your filezilla or get a shell with putty. Again, that is good, but it doesn't make it secure. If your login and password are both "admin", it won't help to have everything encrypted, so I'd advise you to check how to securely set up SSH (using key authentication only, deactivating root login, changing the listening port, using port knocking if you want extra security, etc.)

You have apache2 installed, that's pretty useful for a website, but again the security of your server depends on how it's configured.

In short, some programs can be more secure than others (if they use SSL for example), but it's really their configuration which makes the whole server secure. There's countless resources on this, and unfortunately, it would take too long to get into the details of how to securely configure a Linux server here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.