Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up my first instance on EC2, and trying to find clear information on the security group settings is a bit difficult for a newbie like me. Are there some suggested settings that give a standard level of security for a production website built with PHP and MySQL? In particular, what sort of things should I be looking out for?

share|improve this question
1  
its deny by default, so allowing just tcp port 80 (And someway for you to ssh in) should be ample. –  Sirex Oct 18 '13 at 3:08
    
So these two entries are the only ones I need? –  Chris Oct 18 '13 at 3:46
    
You will need 443/TCP from 0.0.0.0 also if you have HTTPS on your site. –  talonx Oct 18 '13 at 19:00

2 Answers 2

the aws cli tools is what you are looking for.

===> http://aws.amazon.com/developertools/351

you can use them to create a security group (ec2-create-group), assign it to an instance (ec2-run-instance), and add acls (ec2-authorize).....

for instance, to allow tcp/80 from the public internet, you would execute:

==> ec2-authorize [security-group-id] -P tcp -p 80 -s 0.0.0.0/0

all the cli tools can be run with -h for information on usage.

share|improve this answer
    
I understand how to create and assign security groups, but I just want information on the correct settings to use for a 'standard' website with normal access for users –  Chris Oct 18 '13 at 3:47
    
"ec2-authorize [security-group-id] -P tcp -p 80 -s 0.0.0.0/0 "thats the bare minimum you need to have a webserver HTTP up. i listed the two prerequistes. 3 steps. –  nandoP Oct 26 '13 at 23:19

There's a lot of basic information about AWS security groups on the web you can try these:

http://support.rightscale.com/12-Guides/Dashboard_Users_Guide/Clouds/AWS_Regions/EC2_Security_Groups/Concepts/About_EC2_Security_Groups

or

http://cloud-computing.learningtree.com/2010/09/24/understanding-amazon-ec2-security-groups-and-firewalls/

Its important to understand first the fundamentals of a thing/tools before applying it.

With regards to security, you can also implement other approach like using IPtables if your using Redhat base or UFW if your using Ubuntu Linux or installing reverse proxy and other security plugins etc. that will help to harden different level of your security to your website

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.