Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I bought (and just received) a new 1u dell poweredge 860 (got it on ebay for $35).

I finished installing Ubuntu Server (Ubuntu Server 12.04.3 LTS), install apache/mariadb/memcache/php5

works great but I am scared about security.

so far I am the only one using the server but eventually more people (friends, friends of friends) will use this server, use ssh etc...

I want to know what can I do to secure all the information and not get hacked, both from the web or ssh or ddos and any other attack possible.

Does Ubuntu Server does it for you right away? or I have to fix it my self?

Thank you

EDIT:

I installed (so far):

  • All dev tools
  • ssh server
  • LAMP

I didn't install:

  • Graphical interface
share|improve this question

closed as too broad by EEAA, TheCleaner, Dave M, voretaq7 Nov 11 '13 at 17:14

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Your question is very broad, there are many ways a server can get "hacked" (or compromised). Lets focus on the network-facing security - you've listed installed packages that suggest this will be a typical LAMP-like setup. Are there any other network-facing services that you will be running beyond this (e.g., DLNA, Samba, etc.)? –  plasmid87 Nov 11 '13 at 14:37
    
Here's a piece of advice for you: don't give accounts to anyone you don't trust. It's that simple. You aren't an experienced sysadmin, and aren't prepared to deal with potentially malicious users. You could spend weeks preparing this thing, only to have another zero-day exploit announced, after which, the server is compromised, along with all of yours (and your friends) data. –  EEAA Nov 11 '13 at 14:38
    
This QA will likely be helpful in your process. As it stands, though, this is off-topic as it does not related to professional systems administration. –  EEAA Nov 11 '13 at 14:40
    
possible duplicate of Tips for Securing a LAMP Server –  TheCleaner Nov 11 '13 at 14:45
    
@plasmid87 I updated the OP. Does it make sense if I say I install a level 3 server? (my friend just asked me that) –  Pat R Ellery Nov 11 '13 at 14:54

2 Answers 2

up vote 2 down vote accepted

Search can be really useful;

http://askubuntu.com/questions/146775/what-can-be-done-to-secure-ubuntu-server

From the above answer;

Here is a list of things I do to secure my server.

Turn on UFW (sudo ufw enable) and then only allow ports that are actually used. (sudo ufw allow 80)

Make sure MySQL only allows connections from localhost.

Enable TLS on mail services. Even if it's a self signed cert. You don't want passwords sent in the clear.

Install ssh bruteforce blockers like denyhosts or fail2ban. (sudo apt-get install denyhosts) Look into making ssh key-based logins only.

Learn AppArmor. If you use fairly vanilla configurations, then it's extremely easy. Just make sure it's turned on. It will help reduce zero-day exploits.

Depending on physical access to the server, you may even want to look at encrypting the data on the harddisk.

Follow other recommendations in this link. EDIT: I forgot to edit this when I didn't have enough reputation to add more links. The link meant here is the last link below.

Never trust your users. If you are having multiple users with access to the system, lock them down. If you have to give them sudo access, give them only what they need.

Use common sense. Think real hard about how you'd get in if you were ever locked out. Then close those holes.

You should search for "Ubuntu Hardening" and take a look at the very long list you'll get back.

UFW which is mentioned in the quote above stands for Uncomplicated Firewall (https://help.ubuntu.com/community/UFW) which is a great and easy to use way of managing IPTables.

Regarding DDNS type attacks, you may want to look at pairing NGINX as a front-end static proxy for Apache if you're serving web content and then employ something like CloudFlare to handle your DNS and resilience.

There's a wealth of good articles on best practices and service setup over at Digital Ocean;

https://www.digitalocean.com/community/community_tags/ubuntu

The AskUbuntu sister site is also a wealth of knowledge and help relating to your OS;

http://askubuntu.com/

share|improve this answer

This is the article I found most useful - http://www.thefanclub.co.za/how-to/how-secure-ubuntu-1204-lts-server-part-1-basics

The whole thing took only a few hours to go through, most time being spent in the mod_security part as there was an incompatibility with some of the latest OWASP rules and I had to roll back to an earlier version (NB v2.2.5 worked fine and the instructions explain how to apply an earlier ruleset).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.