37

Say I've got a fresh install of Ubuntu, what steps should I take to secure it for use as a Rails application server?

1

10 Answers 10

25

I can't think of any Ubuntu-specific tweaks, but here's a few that apply to all distributions:

  1. Uninstall all unnecessary packages
  2. Use public-key only authentication in SSH
  3. Disable root logins via SSH (doesn't apply to Ubuntu)
  4. Use the production settings for PHP (php.ini-recommended)
  5. Configure MySQL to use sockets only

Of course this list isn't complete, and you'll never be completely safe, but it covers all the exploits I have seen in real life.

Also, the exploits I have seen were almost always related to unsecure user code, not unsecure configuration. The default configurations in minimal, server distributions tend to be pretty secure.

4
  • 1
    Change the port for services like MySQL (useless if to configure it to use sockets only), FTP (although, if you are being secure you shouldnt use FTP at all), SSH and all sorts.
    – Josh Hunt
    Apr 30, 2009 at 11:52
  • 4
    "Uninstall all unnecessary packages". OK. Thats pretty vague. What 'unnecessary' packages?
    – Luke
    Jun 13, 2009 at 5:18
  • 2
    @Luke: Anything you're not using is unnecessary. More specific, running services that you don't need put machines in unnecessary risk.
    – Andrioid
    Jul 11, 2009 at 15:23
  • @Luke: cat /etc/services should give you some ideas.
    – jeshurun
    Nov 14, 2011 at 6:29
18

One quick thing that I do early on is install DenyHosts. It will regularly look through the /var/log/secure, looking for failed logins, and after a couple of failures, block the IP. I set it to block after the first no-such-user, on the second attempt at root, and after a couple of tries for real users (in case you mess up, but you should be using a SSH public key to login).

3
  • 3
    as you link to the sourceforge homepage - denyhosts is also available in the repository (universe) via "sudo aptitude install denyhosts"
    – Olaf
    May 11, 2009 at 20:12
  • good point @olaf. Most of the servers I installed it on were RHEL, where it's also in DAG's repo. May 11, 2009 at 21:55
  • 3
    DenyHosts seems to only detect and block ssh brute force attacks. A better choice would be fail2ban (it is available in the repos as well), which monitors a variety of things, including the apache logs among other things. Check out the community wiki at help.ubuntu.com/community/Fail2ban
    – jeshurun
    Nov 14, 2011 at 6:01
10

Ubuntu is based off Debian and I've found the Securing Debian Manual to be very useful in Debian-based distributions in completely walking you through your system and checking every part. It's basically a really, really comprehensive answer to your question.

2
5

I usually install RKHunter, which scans for rootkits and does integrity checks of various important system binaries. It's in the standard repo, and will run daily from cron. It's not perfect, securitywise, but it's a low-effort item to add, and it provides a measure of protection.

4

Install logcheck, but tweak so that you never receive messages from regular events, otherwise you'll get in the habit of ignoring the emails.

Check which processes are listening using netstat, and make sure nothing's running that doesn't need to run. Many daemons can be configured only to listen on the internal IP (or localhost) instead of all interfaces.

3

Do what Can suggests...

Nmap the host and disable all non-essential services. Use iptables if necessary.

1
  • 2
    On any server that is accessible via the Internet, iptables is always necessary. ;-) May 27, 2009 at 18:28
3

If you're going anywhere near the Internet with the server, install an intrusion detection system like snort.

3

Use separate partitions for various directories like /tmp or /var and mount them with nosuid, nodev and noexec if possible.

3

Some firewall suggestions.

Learn to use a firewall and the concepts of properly locking a box down. Changing default ports is largely a useless thing; proper application and firewall configuration are much more important.

Both are in the Ubuntu repos:

FireHOL

has terrific documentation and very easy to learn syntax. I was able to set up a gateway/firewall in twenty minutes. The only reason I've moved away from this is that it doesn't seem to be maintained (last release 2 yrs ago). Doesn't mean it doesn't work, but...

Ferm

is another one. More iptables-like syntax, but same concept. More community maintained than FireHOL, but takes longer to pick up.

Shorewall

is what I currently use. Its documentation is extensive, and its configuration format is tabular. It took me about an hour and a half to understand all the files needed (6) to get a working firewall/gateway configuration running. It's quite powerful. TIP: The man pages for the different config files are REALLY helpful!

All of these load firewall configurations from a config file. Very effective, easier to use than iptables straight up, and (in my opinion) easier to use and manage than ufw.

Other:

  • I second the recommendations for SSH key use.

  • Set up an IDS.

  • Learn about AppArmor. It restricts the file access of executables to only specified directories and files it needs. Similar to SELinux in the RHEL world. It's installed and enabled with pre-configured 'profiles' for many well-used programs.

2

As well as other suggestions here I'll mention three that are obvious but perhaps worth mentioning for completeness:

  1. If you don't think you need a firewall, think again. ufw is simple but designed for Ubuntu and based on iptables
  2. Update the packages: as a minimum apply all the security patches
  3. Document what you've done to secure the server and why. Include configuring (automated) processes to monitor logs, test the configuration and report security updates that are needed.

Not the answer you're looking for? Browse other questions tagged .