Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Total Linux n00bie - first time VPS setup (Linode.com).

I've spent a month researching and attempting setups. After a few dumps and reinstalls, I finally have a server up and functioning (been up for a few weeks now). I'd love some feedback on my security measures from the experts.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Setup: typical Ubuntu 10.04 LAMP environment

Console: webmin (port 10000)

mail: postfix (port 25)

security measures:

(following http://www.andrewault.net/2010/05/17/securing-an-ubuntu-server/ )

ssh via public/private keys (putty on a win7 machine)

PasswordAuthentication no PermintRootLogin no

UFW

  • ufw default deny incoming
  • ufw default allow outgoing
  • ufw allow 80/tcp (http)
  • ufw allow 443/tcp (ssl)
  • ufw allow XXX/tcp (ssh custom port)
  • ufw allow 25 (mail server)
  • ufw allow 10000 (webmin)
  • ufw deny 22 (ssh default)
  • ufw deny 3306/tcp (mysql)
  • ufw enable

install fail2ban - disallow bruteforce attacks

disallow source routing of incoming packets

sudo sysctl -w net.ipv4.conf.all.accept_source_route=0 
sudo sysctl ­-w net.ipv4.conf.default.accept_source_route=0

install tiger - security scanner

install psad - intrusion detection

install nmap - port scanning

install chkrootkit - root kit presence

install logwatch

UPKEEP

regular (once or twice weekly)

apt-get update/upgrade
run psad, nmap, chkrootkit, logwatch, tiger

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Okay... so, as I said, I'm a complete newb with linux, but I've been involved in web technologies for many years (including many local WAMP / XAMPP installs and setups). Following Linode's basic cookbook entries, getting a server up and running wasn't too tough, but I did feel pretty over my head when it came to the security aspect of things (which is saying a lot, as I deal in complex tech commonly). Hell - if you are a pro with this stuff - props to you. It's hard.

After I got all the virtual server / dns entries ironed out, I was able to set up a few default site installs (drupal, wordpress), and they have been functioning as expected for several weeks now.

I can clearly see in the psad entries that UFW is doing its job - bouncing thousands of port scans, and I have yet to turn anything serious up with tiger. Tho - reading the tiger security report, there are many warnings about system configurations that I'm really not sure if I should take steps to rectify. So there is question #1. For example - I get warnings that my passwords aren't properly hashed. Is this a problem if I have password authentication turned off?

That all being said - How confident can I be in this server setup? Is there a system or service I can use to audit my settings, or to do an automatic system scan? (Something like how you can scan a site for malware with google's web tools.) I'd like to migrate all my sites from shared hosting to this server, but I don't want to do it prematurely...

Any feedback would be most appreciated. I completely realize this question is pretty common, but I feel I've done my due diligence - I'd just like some guidance from the pros on this before I commit.

share|improve this question
1  
Glad to see you taking an interest in, and making an effort, to cleaning up and securing your environment. We also have a sister site, security.stackexchange.com that is wholly devoted to the Information Security field. You might find some good information there too. –  Scott Pack May 19 '12 at 18:24

2 Answers 2

up vote 4 down vote accepted

It sounds like you're on the right track. If you end up getting compromised, it's most likely that it'll happen through vulnerabilities in your application software (you mentioned Wordpress and Drupal). To mitigate these risks, you need to keep abreast of any vulnerability announcements for those products (including any plugins/modules you have installed), and install patches as soon as possible.

Additionally, set up a bullet-proof backup system for the server and do test restores regularly. If you do get compromised, you're going to need to do a complete re-install of your server and data. If you have a good backup system, this process is much less painful.

share|improve this answer
    
Thanks for the feedback! Its been an interesting project, for sure. And seems to be running just fine. But its nice to get a thumbs up before I commit and cancel my shared hosting. I know linode offers a backup service, i will look hard at it. Cheer! –  Bosworth99 Jan 27 '12 at 21:39
1  
Keep in mind that while Linode's backup service works great, it's not offsite. It's in a different host in your same datacenter. You ought to do some sort of off-site backup in addition to Linode's service. –  EEAA Jan 27 '12 at 21:50
    
Duly noted! :D thanks for the insight. –  Bosworth99 Jan 27 '12 at 21:58

If you are not running an actual mail SERVER on the VPS ( as in, you are RECEIVING mail that people or machines send to it), you need not and should not open port 25 inbound. The mail service will the most interesting target for misuse. And you should better "PermitRootLogin without-password" (read the manpage, that option does the opposite of what it sounds like!).

Some of the other measures (heap on every security tool available :) might not be BAD, and might even be the better thing to do in the beginning, but will actually make your project high maintenance. The "Zen" way is "if you do not want,need or understand it, then you do not install or run it." Run "netstat -apn" and look at the first list. Anything that does not need to be there (that often includes ipv6 binding of some server daemons) at all you disable, anything that can be bound to localhost only you bind to localhost only.

If you are knowledgeable about general linux operation, find -perm 4000 -o -perm 2000 and analyze why these programs need to be setuid/setgid, and especially if they need to be for your purposes (eg if the only person ever changing a user password on the system is root or a root equivalent, the password changer binary needs no setuid.). BTW, the proper way to change perms on package managed files in debian/ubuntu is dpkg-statoverride, do not chmod stuff or updates might change it back unexpectedly.

share|improve this answer
    
To expand: If you do these things, the only thing you need firewalling for in this setup is as an additional foil to somebody who has already broken in and wants to use the limited privileges he obtained (anybody who managed to get root can get rid of the iptables rule anyway) to further expand in your system or use it for his purposes. So a local firewall is good layered security practice, and bad minimalism practice :) –  rackandboneman May 21 '12 at 0:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.