How to secure a dedicated Linux box for e-commerce use? [closed]

Question

My question has been asked, and I have done a lot of research. But I have yet to get a list of straight forward steps to get this done. I do not ask for an exhaustive explanation, just a really good guideline, or a link to one. Most of them just tell you to do the research, yet there are not that many resources to get this done. Worst of all, none are good enough for production use, but rather tell you to do more research; of which there is very little, for production use in e-commerce anyways. I have also encountered many saying hire someone, to which I say, "how did they learn it to get hired?!" I would just like to get a nice list of guidelines to make sure I can do it right.

This also leads me to a specific question I have on chrooting. Symantec has a few tutorials on this, which claims to be much more secure. From what I have read, it doesn't seem to be any more secure due to the fact that it is only a change in directory structure. Wouldn't shutting down the services, which chrooting aims to do in a more complicated manner, accomplish the same thing? Or is it actually much more secure?

Thank you, and sorry if I sound pushy, but I really cannot find a good answer, or at least a good lead to allow me to do the research in order to learn how to set one up and run it. Ultimately I will be using a hosting provider, but the goal is to gain the knowledge to be able to administer it for as long as I can until it does make sense to hire someone specific.

Answer 1

About chroots: You got this totally wrong, I guess. This is not about shutting down services in any way, but about caging them. You create a directory structure which will be a new "virtual filesystem" with the base of this tree as the "ch anged root directory" which the process and any child processes it might create cannot leave. Thus, if an attacker gains control over the service, he will have no way to get control over other parts of the system because he is restricted to the chroot environment. And yes, this has a significant security benefit.

About building secure servers: I don't think you can do this with following a tutorial, because you won't know what you are really doing and what you are protecting against. Frankly, your remarks regarding chroots leads me to believe that you are missing a lot of fundamental sysadmin knowledge you need before you will have a chance to understand all the implications of building a "secure system".

Anyway, what you need to protect against is totally dependent on your situation, the applications you use, environment they are running in and, most important, your threat model. There is no golden way which will result in an unbreakable system.