Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Linux EC2 Instance Security Consideration

I am going to host a web site in Amazon EC2 instance which would be a Linux instance. My web application will be developed using PHP, Apache and MySql. As I am new to Linux and Amazon EC2 environment, what are key areas in security should I consider to protect my server? This may be very very generic question as the security itself a vast area. But I need to kick start with most imporant points. That way I would be able to track down all those areas one by one.

share|improve this question

migrated from webmasters.stackexchange.com May 19 '11 at 14:28

This question came from our site for pro webmasters.

marked as duplicate by mrdenny Nov 22 '11 at 12:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

2 Answers

The NSA released a guide on how you should secure servers today. It's written for RHEL5 but useful for other distro's as well.

Some of the things you really want to do:

  • Lock down SSH (Key-authentication, change port)
  • Update everything, all the time
  • Firewall! (Iptables and/or build-in EC2-firewall)
  • Use SELinux or AppArmor
  • Least Privilege (run everything with the least amount of privilege)
  • Try to avoid installing software you don't really need (higher chance of vulnerabilities)
  • Use HTTPS
  • ...
share|improve this answer
add comment

Yup - that's very general. Here's som every general advice:

  1. Ensure that you have a decent firewall in place.
  2. Turn off everything you don't need.
  3. Secure what you do need (e.g. SSH should only allow logins with keys, if possible access should be restricted by IP as well)
  4. Ensure that what you DO need isn't subject to any known vulnerabilities
    This is an ongoing process - You'll need something like OpenVAS or Nessus, or a lot of free time to peruse CERT advisories
  5. Ensure that your application programmers are not feckless morons (they need to write relatively secure code, otherwise you're pretty much guaranteed to have a compromise - SQL Injection, remote execution vulnerabilities, etc.)
share|improve this answer
add comment