Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a Virtual Private Server for accessing Web-Services used only on the Mobile devices, there are many entries in the access and error log, even there is nothing on the web server.

I am little worried about server security.

Things I have done..

Installed Fail2Ban
rkhunter
using SSH login
root login disabled.

I am using Server with LAMP configuration.

What other security I should use to protect against attacks ?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

It seems you have now protected the back door of your bank, but forgot to lock the front door.

Why I'm saying that?

You seem to be worried about your ssh security. Great, it's definitely an area worth protecting well! But the most likely (successful) attack vector will be from the web. Typical botnets will just blindly try to load common vulnerable URLs - if you don't have anything like phpBB or WordPress installed, you don't need to worry. Also if you see Windows related URLs, you don't need to worry about them on your Linux server.

Typical web attacks include

  • SQL injections. If the data sent by your users is not properly validated and your application is not using prepared SQL queries, it's possible to inject additional SQL queries via web and alter/download your SQL data that way. Seemingly harmless feedback form might open a door for SQL injection if for example the data coming from feedback text area is not properly validated.

  • Cross-site scripting (XSS). By using JavaScript it's possible to perform all kinds of nasty things from phishing to pwning the client's computer.

  • (Distributed) Denial of Service attacks. Botnets try to bomb your server by sending tons of requests, accessing knowingly heavy pages and/or violating TCP standard.

  • Spamming. Sometimes spammers try to abuse your web server by using some known vulnerability, enabling them to send out their spam from your server. Alternatively - or more likely - they nowadays tend to spam your bulletin boards, blog comments and so on.

How to protect against such things?

  • Best defence is not to be present at all. If you don't need some Apache module or PHP extension, disable it. If you don't need some functionality in your blog / CMS software, disable it.

  • Use mod_security. This Apache module is a heavy-weight champion when it comes to protecting your web applications. Word of warning: for many this module is overkill and properly configuring it can be tedious.

  • Keep your software up to date. Don't be lazy when it comes to updating your web applications! Security vulnerabilities are common in them.

  • Do not rely on "it's not running as root, I'm safe" mantra. I often see people believing that software not run as root = safe. Well, newsflash! Root access is not needed for outbound http connections, sending e-mail or performing SQL queries.

  • Use firewall. Firewall everything that is not needed. If your server does not need to establish outbound http connections ever, then drop them in your firewall.

share|improve this answer
    
You've managed to wrestle a good answer out of a poor question. Nicely done. –  womble Aug 3 '11 at 8:03
    
Thank you, I'll be here all week. –  Janne Pikkarainen Aug 3 '11 at 9:59
    
I'll make sure I don't forget to tip my waitress. –  womble Aug 3 '11 at 10:02
    
@Janne Thank you for such a great explanation. I am newbie (I know every other post has this line :-).. ) so it's kind of hard to know all the Apache module and PHP extensions and turn on/off them.. I don't expect someone spoon-feed.. looking for right directions.. I am looking at this post on IP-Tables will having relevent or all ?? these rules will help ??thegeekstuff.com/2011/06/iptables-rules-examples –  theLeo Aug 4 '11 at 2:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.