This question already has an answer here:
- Tips for Securing a LAMP Server 5 answers
I'm using Ubuntu 12.04 on an Amazon EC2 instance and new to the sysadmin side of things. I'm working on a little project of my own and I'm already starting to get targeted by bots (at least I hope they're bots).
I'm using PHP and in my error logs I noticed
w00tw00t romanian anti-sec and
/w00tw00t.at.blackhats.romanian.anti-sec:. I googled and I found several results such as this and this which both state it's most likely just some bots. They were looking for variations of PHPMyAdmin, PMA, MyAdmin. From what I can tell, they did not find anything and only got some 404 errors. As far as PHPMyAdmin goes, I'm using an alias and I have access restricted to a couple of IP addresses.
Currently I'm running UFW and I have these rules
To Action From -- ------ ---- 80 ALLOW Anywhere 443 ALLOW Anywhere 22 ALLOW MY.IP.ADDRESS1 22 ALLOW MY.IP.ADDRESS2 22 ALLOW MY.IP.ADDRESS3 80 ALLOW Anywhere (v6) 443 ALLOW Anywhere (v6)
All of the tutorials I've seen on UFW just say how to set it up, not suggestions on the configuration itself. Basically I use SFTP and SSH (with a key pair) to work on my server. Are there any rules that are a must have that I am missing?