Linux web severs and security essentials (and beyond the essentials)

Question

I'm learning Java, PHP, HTML, xml, ajax and other web and Linux related stuff.

Once every while I find someone giving me cryptic and scary warnings about security, say: "...if connected to Internet don't install php if you don't know what you are doing..."

So far I can't claim that I know what I'm doing.

So... what should I study in order to obtain a sufficiently deep and practical understanding about how to develop a formally secure server and/or Internet exposed Linux system?

(I say "formally secure" because I understand that ultimately any system has security vulnerabilities.)

Is there a bible like book? or a list of recommended topics?

What are the most important considerations?

What technique or method (if any) is the best to test the security of a server?

Thanks

Answer 1

If you check out this question on IT Security Stack Exchange the answers there should give you some idea. The best solution bar none is experience - build systems, build networks (in VM's if you don't have the necessary infrastructure) and run security attack tools and methods against them. If someone mentions php vulnerabilities, build a test server running php and use some published exploits against it to watch what happens.

If you ever need a tool to prove how easy all this is for the unskilled, Metasploit is your friend.

Answer 2

I think you might be asking for Nessus. This is a good start for quick audits, but I would not rely on it as your only solution, obviously.

Answer 3

Take a look at snort

I think you can be pretty effective with any pro-active (honey pot->throttle/ban) approach. We are still at the stage where majority of attackers do not expect you would have pro-active security on general purpose web sites.

On the other hand if you do have something valuable or expect stronger (more sophisticated) attacks then budget for defence (policies, audits, consultants, IT security officer position, etc).

Answer 4

The fundamentals, whether Linux or other, is Network, Host and Application security.

With regard to Network you want to ensure that you have proper firewall rules. i.e. That you're not exposing ports you don't need to. Have a private VLAN at Hosting Provider, etc. Use tools like nmap to test that the ports are indeed closed/filtered.

With regard to Host you want to ensure that you follow security errata for the OS you're running and patch as soon as practically possible.

With regard to Application security you want to ensure that you harden the Services (e.g. Apache, MySQL) by doing things like not disclosing information (ServerSignature Off, ServerTokens Prod for Apache, expose_php=Off in php.ini) and using least-privileged grants (no GRANT ALL PRIVILEGES in MySQL. Run a Web Vuln Scanner like nikto against your own app.

Also use random passwords - use a Password Manager like Password Gorilla or other.

There is of course much more to learn, but even these little things help and it might be enough to deter an undesirable (of course this depends on what your app is and how motivated they are).

Cheers