2

I'm kinda new with servers, but I know my way around. Now I've got a server configured, only I'd like to know if this setup is safe for production use, or if I could do some things better.

OS: Centos 5.3, basic installation with Apache, MySQL and PHP Open ports: 22 for SSH/SFTP access, 80 for HTTP and 3306 for MySQL (only my IP has access, of course with identification)

I've configured Apache so that virtual hosts are allowed, and each domain has it's own folder in /var/www/domain.ext

Now, is this safe or am I missing stuff?

Thanks for you're advice, it's appreciated =)

5 Answers 5

2

I would suggest changing the port of SSH and MySQL to something non-standard to avoid casual port scans.

If MySQL is only locally, I would avoid opening a port for it at all and use a socket instead.

Also, make sure you apply security patches as soon as they come out, and read and follow all of the security documentation for the products you're using.

3
  • Changing the port isn't a bad idea =) About MySQL sockets, then it's only possible to connect to MySQL (with PHP in this case) on the server only? This way, I can't manage MySQL from another computer.. that's why I need to open MySQL, or is there a better way to accomplish that?
    – Stefan
    Sep 25, 2009 at 22:50
  • 2
    run mysql on 127.0.0.1, so you can ssh port forward if you need to connect to it from a different machine.
    – Cian
    Sep 27, 2009 at 10:11
  • @Cian: Good suggestion
    – Ben S
    Sep 28, 2009 at 14:25
2

Wow, that's a wide-open question. There are a lot of things to think about, from configuration details of the OS, to SSHd options (allow public key only), to Apache configuration, which can be a full-time specialty.

MySQL can be configured to not use TCP networking at all, but to use Unix sockets instead. I'd recommend that.

Then, don't forget that you need to carefully plan and design the application that runs on top of it all. Since code that's more commonly used tends to be more commonly reviewed, that's an area I'd look at pretty hard.

Starting from the bottom, there are several freely-available configuration guides and utilities that will help tremendously to get you started:

OS

CentOS Wiki

NSA Guidelines

DISA Guidelines

Apache

DISA Guidelines

Nikto

Paros

1

add mod_security

2
  • Could you explain me why I should add mod_security?
    – Stefan
    Sep 25, 2009 at 22:45
  • you asked for safety; mod_security tries to take care of that aspect regarding to serving web pages
    – quaie
    Sep 27, 2009 at 9:20
1

my standard guide for Linux security is the Securing Debian Manual. you may need to change specifics for CentOS, but the concepts are solid.

summary:

  • DENY first, ALLOW only whats needed.
  • fail2ban
  • SSH keys
  • logcheck
  • integrity checking
0

Stefan, you can tunnel the mysql connection via ssh to manage it from other machine. It still think that you are connecting to it locally as per the my.cnf setting, but you need to ensure the privileges table has [email protected] with the proper permission level since you are connecting to it via the tunnel.

Or you can simply installed phpmyadmin and enable only local access and tunnel that over ssh also.

p/s: -I can't comment since not enough point :p, which is why i have to put this as an answer. -I agree with Ben answer to change standard port to custom port number for ssh and etc.

You must log in to answer this question.