Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I plan to rent a dedicated server to host a commercial application, which should house esentially everything necessary to run on a single machine (frontend, backend, databases, analytics, backup systems, etc) for the time being. This is indeed a simplistic infrastructure, but I don't expect high amounts of traffic for now, so I believe it will suffice for the time being.

Now, I understand the same hour I put the server online I'm going to have malicious people trying to get root access to it, so obviously I would like to take care of this from day one. The question is, do I need a to rent a physical firewall, physical as in being a different machine, with this setting (which my provider offers, but at a cost of pretty much doubling the price), or will I be able to cover my ass with a software firewall (ie iptables and co), provided it is properly configured + I take as many "software" security measures/good practices as I can?

My networking/server administration experience is admittedly limited, but I'm very much willing and eager to learn as much as I'm able to manage the server/s on my own.

share|improve this question
    
@ErikA why so serious :) –  Mahn Aug 24 '12 at 19:19
    
It makes for a better question. You'll get attacks from all over the world, not just one particular place. –  Michael Hampton Aug 24 '12 at 19:22

2 Answers 2

up vote 6 down vote accepted

You really don't need a separate firewall for a single host; Linux iptables is more than sufficient to protect the server, and (if you run Red Hat/CentOS) will be on and reasonably secure by default.

The first thing you will want to do after the server is up is to make yourself a user account, and then secure ssh by denying root logins with a password. In /etc/ssh/sshd_config set either:

PermitRootLogin no

or:

PermitRootLogin without-password

if you want to be able to login as root with ssh keys.

share|improve this answer
    
Thanks, much appreciated. –  Mahn Aug 24 '12 at 22:21
1  
Also, installing Fail2ban and Logwatch is great for security (banning forcebrute authentications and generating activity logs) –  Kedare Aug 28 '12 at 7:46

The kinds of factors that drive the need for a dedicated server don't necessarily correlate to volume of traffic or typically observed threats. A site with massive back end I/O requirements might hand out small amounts of tabular data to a handful of users. The decision to pursue a dedicated firewall should be approached in the same way. The other point, of course, is that adding a dedicated firewall later isn't (or shouldn't be) very invasive.

share|improve this answer
    
Thanks, can you elaborate on the factors one should consider to decide whether a dedicated firewall is the right fit? –  Mahn Aug 24 '12 at 22:27
1  
Volume and rate of traffic, external requirements for physical separation of administrative functions (driven by auditors, PHB's, etc), risk/frequency of DDoS attacks, need for special functions beyond those in the shared offering and certain VPN situations. There are other examples but overall you'll know when you get there. –  rnxrx Aug 25 '12 at 0:55
    
Thanks, makes sense. Sorry that I can't upvote twice :) –  Mahn Aug 25 '12 at 1:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.