Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My question has been asked, and I have done a lot of research. But I have yet to get a list of straight forward steps to get this done. I do not ask for an exhaustive explanation, just a really good guideline, or a link to one. Most of them just tell you to do the research, yet there are not that many resources to get this done. Worst of all, none are good enough for production use, but rather tell you to do more research; of which there is very little, for production use in e-commerce anyways. I have also encountered many saying hire someone, to which I say, "how did they learn it to get hired?!" I would just like to get a nice list of guidelines to make sure I can do it right.

This also leads me to a specific question I have on chrooting. Symantec has a few tutorials on this, which claims to be much more secure. From what I have read, it doesn't seem to be any more secure due to the fact that it is only a change in directory structure. Wouldn't shutting down the services, which chrooting aims to do in a more complicated manner, accomplish the same thing? Or is it actually much more secure?

Thank you, and sorry if I sound pushy, but I really cannot find a good answer, or at least a good lead to allow me to do the research in order to learn how to set one up and run it. Ultimately I will be using a hosting provider, but the goal is to gain the knowledge to be able to administer it for as long as I can until it does make sense to hire someone specific.

share|improve this question

closed as not a real question by Ward, Khaled, Sven, andol, symcbean Dec 28 '11 at 11:04

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

You've done "a lot of research" and can't begin to answer your own questions - but you expect an answer to be posted here? – symcbean Dec 28 '11 at 11:04
Well I can begin to answer my question, and re-reading it, I can imagine why it is sort of vague. But from what I have gathered, securing the different services on a LAMP server is the obvious one, as well as using SSL. But then when I search for a better answer to securing a LAMP server for commercial use on an e-commerce site, thats where answers thin out. Key is e-commerce website, but I do apologize for the vagueness. That being said, I did specifically state I am not looking for an in depth answer, but merely a point in the right direction. Thanks for the point in the right direction... – Andy Jan 3 '12 at 5:39

1 Answer 1

About chroots: You got this totally wrong, I guess. This is not about shutting down services in any way, but about caging them. You create a directory structure which will be a new "virtual filesystem" with the base of this tree as the "ch anged root directory" which the process and any child processes it might create cannot leave. Thus, if an attacker gains control over the service, he will have no way to get control over other parts of the system because he is restricted to the chroot environment. And yes, this has a significant security benefit.

About building secure servers: I don't think you can do this with following a tutorial, because you won't know what you are really doing and what you are protecting against. Frankly, your remarks regarding chroots leads me to believe that you are missing a lot of fundamental sysadmin knowledge you need before you will have a chance to understand all the implications of building a "secure system".

Anyway, what you need to protect against is totally dependent on your situation, the applications you use, environment they are running in and, most important, your threat model. There is no golden way which will result in an unbreakable system.

share|improve this answer
Thank you for your input SvenW. Where do you recommend I go to get the systadmin knowledge? – Andy Jan 3 '12 at 5:29
@Andy I think most of us probably learned on either an apprenticeship-style arrangement with someone, or by making lots of mistakes and learning from them. – ceejayoz Jul 30 at 23:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.