Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been developing webapps for a while ... and I always had a sysadmin which made the environment perfect to run my apps with no worries.

But now I am starting a project on myself, and I need to set up a server, knowing near to nothing about it.

All I need to do is just have a Linux, with a webserver (I usually used Apache), PHP and MySQL. I'll also need SSH, SSL to run https:// and FTP to transfer files.

I know how to install almost everything (need advice about SSL) with Ubuntu Server, but I am concerned about the security topic ... say: firewall, open/closed ports, php security, etc ... Where can I found a good guide covering this topics?

Everything else in the server... I don't need it, and I wanna know how to remove it, to avoid resources consumption.

Final note: I'll be running the webapp at amazon-ec2 or rackspace cloud servers.

Thanks in advance!!

share|improve this question
4  
...and FTP to transfer files. - Oh God, no no no. Don't use FTP. It's not 1997. You are already going to have SSH available, use SCP or SFTP. –  MDMarra Oct 8 '12 at 14:30
    
Vicenc, I must warn you that I suspect this question will get closed, because it's not a question at all; you're asking for a complete tutorial on configuring, securing and optimising a server. This isn't a good place for an open-ended question like that. If you can refine this question, I would; otherwise, the obvious answer is "get a contract sysadmin in". –  MadHatter Oct 8 '12 at 14:30
    
sorry if the question is not a good one ... I am kinda new in here ... nevertheless thank you for the advice ... I know the the obvious answer is that one, but I wanna learn ... and I am developing a free tool... so I can't invest that much. –  Vicenç Gascó Oct 8 '12 at 14:33
1  
Seriously though, google "How to secure a Linux web server" and you'll get enough reading material to keep you busy for the rest of the day. –  Safado Oct 8 '12 at 14:37
1  
"I want it to be as secure as possible" means you'll be spending time doing it. Otherwise, it simply won't be as secure as possible. –  ceejayoz Oct 8 '12 at 15:18
show 1 more comment

closed as not a real question by MadHatter, MDMarra, Zoredache, pauska, Iain Oct 8 '12 at 15:35

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 1 down vote accepted

I've been developing webapps for a while ... and I always had a sysadmin which made the environment perfect to run my apps with no worries.

But now I am starting a project on myself, and I need to set up a server, knowing near to nothing about it.

You need to hire a sysadmin. If nothing else, to teach you the basics and back you up where you have knowledge gaps.
What you're saying here is the equivalent of "I've always taken my car to the mechanic when it needed work, but now I'd like to replace my engine in my driveway" - We can give you the shop manual and some tools, but there's a better-than-50%-chance that you're going to wind up wrecking it.

Assuming you don't want to heed the sound advice I just gave you, keep reading…


I know how to install almost everything (need advice about SSL) with Ubuntu Server, but I am concerned about the security topic ... say: firewall, open/closed ports, php security, etc ... Where can I found a good guide covering this topics?

"Need advice about SSL" is way too broad to net you a good answer. What don't you understand about it? (Are you unclear on how to get a certificate? Your CA can walk you through that process. Are you not sure how to install the certificate so Apache can use it? Most CAs have a quick guide, and the Apache manual (SSL section) is also something you should be familiar with.

The broader topic of security is generally unanswerable, but based on your "I'm not a bank" comment I can tell that you have the wrong general attitude about security.
Security is not something you get from a guide, and it's not something you hand-wave away -- It's a way of looking at systems (and configuring them, and maintaining them) to reduce the risk of a compromise to the lowest practical level, and a commitment to keep your systems up to date in order to maintain that low risk level.
Any decent security guide will take an inexperienced user starting from zero more than a day to work through, and probably another day or two to turn into a server configuration (expect to break things and have to start over at least once).
An experienced sysadmin can blast through the process of securing a server more quickly because they've done it before. Also the benefit of experience is they'll probably know to do things that don't show up in Joe Random's Security Tutorial.


Everything else in the server... I don't need it, and I wanna know how to remove it, to avoid resources consumption.

Things that are not running do not consume resources (except disk space, which is practically infinite unless you're doing data warehousing), and generally pose only limited security threats. With the exclusion of paranoia-level security (down to removing compilers from your production hosts) a generic Linux box with unnecessary stuff turned off is a pretty secure starting point.

That said if you want to take a machete to your system and start hacking away at installed software you really need someone who has done it before to guide your hand. Debian/Ubuntu is generally a very newbie-friendly system, but if you tell it you want to uninstall half the system it will do what you ask - possibly leaving you with an unusable machine in the process.
An experienced admin will know what you must keep, what you should keep, and what needs to be removed or disabled. Developing that list is environment-specific, and beyond what we can do on a simple Q&A site.

share|improve this answer
    
Thank you. Having this reply I think that what I should do is to create a little part of the webapp that I am preparing and develop it just with MAMP. Once it is done, I'm going to hire a sysadmin for 15 days to guide me over the process and to teach me about it, so I am ready to do it myself in the future. I think that this viewpoint of the situation will be better for my future business. Thanks again. –  Vicenç Gascó Oct 10 '12 at 11:49
add comment

For start I always suggest keeping your install at a minimum level with only the packages you need. To make it easy, install chkconfig and run chkcongig --list to see which service starts at boot, proceed with either disabling the service to start at each reboot ( chkconfig SerViceName off), or completely uninstalling it ( dpkg --purge PackAgeName.)

Installing chkconfig from Ubuntu apt-get clean && apt-get update ; apt-get -y install chkconfig

For firewall I recommand iptables because is very easy to use Mysql can be fine tuned and enforced with a password. Keep port closed to outside world with iptables if you don't need access from outside, or at least restrict it per IP address. Guidelines for security - I prefer http://www.nsa.gov. Example: http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml#linux2

share|improve this answer
    
Thanks! I'll take a look :) –  Vicenç Gascó Oct 8 '12 at 14:40
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.