Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is a CentOS 6.2 system.

For my login with the hosting company website, I set a 20-character mixed case, letters, numbers, symbols password and enabled two-factor authentication.

In /etc/ssh/sshd_config I turned off remote root login and turned of password-based login.

I'm running sshd, Apache, SSL, and MySQL on standard ports (although MySQL should only be accessed from within the same host).

I plan to run yum update -y as a daily cron job. (should I make it hourly?)

I ran this script to configure my firewall...

*filter

-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A OUTPUT -j ACCEPT

-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

Are there any changes that anyone would recommend?

(I realize that any apps I deploy may have their own security issues such as SQL injection or cross site scripting). For now, I'm just talking about the bare setup so far.)

share|improve this question

closed as primarily opinion-based by Sven, mdpc, Ward, Falcon Momot, faker Aug 25 '13 at 6:52

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Define "reasonable" secure? This is so context dependent that it can't be reasonably discussed here. Also, why do you care about firewalls and stuff it you don't even keep your server updated to the newest version of the base OS, which is 6.4? –  Sven Aug 24 '13 at 15:21
    
I think he pretty much described the context. –  platforms Aug 24 '13 at 15:50
    
@SvW Sure, no prob. By "reasonably secure" I mean that if I posted the I.P. then you, personally, would be unable to break in. I went with 6.2 because that's what my the hosting company offers and they spend all day, every day evaluating O.S. versions and have a huge financial stake in choosing the right ones (whereas you, in contrast, appear to have spare time to make snarky, obstructive, unhelpful, time-wasting comments on ServerFault). –  Agvorth Aug 24 '13 at 15:50
3  
@Agvorth: IF they spend all day evaluating OS releases why are they 2 behind ? –  Iain Aug 24 '13 at 16:30

1 Answer 1

up vote 3 down vote accepted

No, it is not secure. It is CentOS 6.2, which is rather old. You should update to the latest released CentOS 6.x and keep doing so. I would also not automatically run yum update, but get nagios to alert you when there are security updates, so you can update manually.

Your firewall is reasonably safe, but I'd replace the trailing -j REJECT rules with a simple REJECT policy on the input and forward chains.

Your SSH config is ok, but if you want to improve it, you could use two-factor authentication with e.g. duo security.

Some more things I would add:

  • ossec for anomaly detection
  • fail2ban for automatic blocking of ssh attacks
share|improve this answer
1  
Yes, having automatic updates through yum might sound like a good idea but it can make your system very troublesome to troubleshoot, because how to you make sure what version reproduced a bug or the like. It being a CentOS System, I'd really invest some time getting it working with SELinux too because it sounds like you are running only stuff which should run well with it on. –  Petter H Aug 24 '13 at 18:46
    
Thanks, I appreciate you taking the time to answer my question and provide specific advice. It's a help. –  Agvorth Sep 4 '13 at 0:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.