Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a hobbyist IT guy and I am running my own Ubuntu server to serve up my website. I was wondering if there are any good ways to find out how secure my setup is, as I'd really prefer not to have my network compromised.

Do you know of any automated tools and/or good guides for securely setting up a LAMP stack?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

If you installed Apache from the repository, it is already safe enough IF you keep it updated. Most attacks nowadays rely on old vulnerabilities on web applications and brute force attacks via FTP or ssh.

That being said, you can always improve the security of your Apache/PHP with a few best practices, including the PHP security manual and the Apache CIS benchmark:

As the next step, I would recommend monitoring your system. Look at the logs, file changes, etc. The best tools for that are:

You can always monitor your web site remotely, using Network-based Integrity monitoring (that looks for web site changes, whois modifications, blacklisting, etc) using Sucuri (it is a free tool that I developed).

share|improve this answer
    
Thanks for the help :) I used to work as a dev for a registrar (rebel.com if you are interested), so I appreciate what your tool can do - domain name hijacking is a serious threat! –  Thunder3 Jul 19 '09 at 2:12

There are a multitude of tools on the Internet for security scanning, plus of course tools for launching actual attacks. Why not get hold of some and run them against your web server. Monitoring to see what has happened is one thing. Seeing what actually gets through, and possibly brings it down, is another thing altogether. Not all attacks will be obvious in the logs.

share|improve this answer
    
Do you have any recommendations for tools to use? :) –  Thunder3 Jul 19 '09 at 3:49
    
It's a pretty dynamic area, so I'm reluctant to recommend any particular software because there's always new ones appearing. Just Google for "web server vulnerability tester" and similar terms. There's no shortage of them. –  John Gardeniers Jul 19 '09 at 4:45

Nessus and MetaSploit would be good tools to start with. That said, you also need to make sure any web apps running on your server are also secure - that is not as easy to determine with scanning tools.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.