Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On an existing iPlanet webserver, we now have to install PHP5 and MySQL 5 on Red Hat Enterprise Linux 4. Are there any recommended guides or best practices for safely installing these 2 tools and hardening them from hackers on this public facing server?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

First on my list would be to pick a platform which has full support from the distributor - not just legacy support (RHEL4 is now five and half years old and about to go into 'production 3' support mode).

Next on my list would be NOT INSTALLING SOFTWARE WHICH VOIDS the support warranty.

Then I'd have a long hard look at hardening the Operating System - but since you only asked about specific applications I'll skip over that.

Regarding hardening the 2 services....the very basic introduction to Linux hardening from Sans is 15 pages - so I'd strongly recommend you look elsewhere for answers - a quick post on SF will not provide you with a fraction of the questions you need to ask. There are some more guides here.

Do have a look at the suhosin website - even if you stick with the standard distributions of PHP there's a lot of information about why suhosin exists from which you can make informed decisions.

As for mysql - it certainly should not be public facing. In addition to firewalling, you should be disabling all network access if possible - or moving it to a separate server not routable from the internet.

Similarly for mod_security

share|improve this answer

First of all, note that doing this will basically make the server unsupportable by Red Hat, so you're on your own if trouble comes up.

Now that that's out of the way, you'll find MySQL 5 and PHP 5 packages for EL4 in the CentOS Plus repository. Despite the name, these packages will work on both CentOS and RHEL.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.