Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm kinda new with servers, but I know my way around. Now I've got a server configured, only I'd like to know if this setup is safe for production use, or if I could do some things better.

OS: Centos 5.3, basic installation with Apache, MySQL and PHP Open ports: 22 for SSH/SFTP access, 80 for HTTP and 3306 for MySQL (only my IP has access, of course with identification)

I've configured Apache so that virtual hosts are allowed, and each domain has it's own folder in /var/www/domain.ext

Now, is this safe or am I missing stuff?

Thanks for you're advice, it's appreciated =)

share|improve this question

5 Answers 5

Wow, that's a wide-open question. There are a lot of things to think about, from configuration details of the OS, to SSHd options (allow public key only), to Apache configuration, which can be a full-time specialty.

MySQL can be configured to not use TCP networking at all, but to use Unix sockets instead. I'd recommend that.

Then, don't forget that you need to carefully plan and design the application that runs on top of it all. Since code that's more commonly used tends to be more commonly reviewed, that's an area I'd look at pretty hard.

Starting from the bottom, there are several freely-available configuration guides and utilities that will help tremendously to get you started:

OS

CentOS Wiki

NSA Guidelines

DISA Guidelines

Apache

DISA Guidelines

Nikto

Paros

share|improve this answer

my standard guide for Linux security is the Securing Debian Manual. you may need to change specifics for CentOS, but the concepts are solid.

summary:

  • DENY first, ALLOW only whats needed.
  • fail2ban
  • SSH keys
  • logcheck
  • integrity checking
share|improve this answer

Stefan, you can tunnel the mysql connection via ssh to manage it from other machine. It still think that you are connecting to it locally as per the my.cnf setting, but you need to ensure the privileges table has admin_user@127.0.0.1 with the proper permission level since you are connecting to it via the tunnel.

Or you can simply installed phpmyadmin and enable only local access and tunnel that over ssh also.

p/s: -I can't comment since not enough point :p, which is why i have to put this as an answer. -I agree with Ben answer to change standard port to custom port number for ssh and etc.

share|improve this answer

add mod_security

share|improve this answer
    
Could you explain me why I should add mod_security? –  Stefan Sep 25 '09 at 22:45
    
you asked for safety; mod_security tries to take care of that aspect regarding to serving web pages –  petre Sep 27 '09 at 9:20

I would suggest changing the port of SSH and MySQL to something non-standard to avoid casual port scans.

If MySQL is only locally, I would avoid opening a port for it at all and use a socket instead.

Also, make sure you apply security patches as soon as they come out, and read and follow all of the security documentation for the products you're using.

share|improve this answer
    
Changing the port isn't a bad idea =) About MySQL sockets, then it's only possible to connect to MySQL (with PHP in this case) on the server only? This way, I can't manage MySQL from another computer.. that's why I need to open MySQL, or is there a better way to accomplish that? –  Stefan Sep 25 '09 at 22:50
2  
run mysql on 127.0.0.1, so you can ssh port forward if you need to connect to it from a different machine. –  Cian Sep 27 '09 at 10:11
    
@Cian: Good suggestion –  Ben S Sep 28 '09 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.