-8
votes
1answer
90 views

LAMP Installation and security [closed]

I installed LAMP server on Ubuntu 13.04 using this tutorial word to word. It worked nicely. But I am hardly able to understand these steps : $ sudo usermod -a -G www-data your_user $ sudo chgrp -R ...
0
votes
1answer
504 views

Who should own /var/www? [duplicate]

Possible Duplicate: How should I structure my users/groups/permissions for a web server? I've seen a few answers to this on the internet, but I'm looking for a definitive answer. I have a ...
1
vote
1answer
410 views

Is suPHP any more secure than alternatives?

I have a web application needs write access to certain folders on a LAMP server. Since suPHP / suEXEC escalate operations to an account you specify, it seems like your server is no more secure ...
0
votes
1answer
455 views

Optimized LAMP/LEMP stack scripts

In the "let's try not to reinvent the wheel" perspective, I've been looking for a packaged LAMP (or LEMP) stack for some time now, not only the basic Mysql, Apache , PHP etc... but ideally stuff like ...
1
vote
1answer
465 views

Adding Apache to a Developer Group (Web Permissions)

On a private server with an application that needs write access (Wordpress), is it better to add Apache's web user (www-data) to the "developers" group that owns /var/www or use fastcgi / suphp ...
1
vote
3answers
541 views

Firewalls (ufw vs apf) on Ubuntu

On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in ...
4
votes
2answers
260 views

Keep LAMP server up to date and secure

As a webdeveloper I have, like many, my own VPS. However, I am a webdeveloper, not a system manager. For me it's quite challenging to install a VPS and to keep it up to date and secure. It takes me ...
-5
votes
1answer
94 views

How to secure a dedicated Linux box for e-commerce use? [closed]

My question has been asked, and I have done a lot of research. But I have yet to get a list of straight forward steps to get this done. I do not ask for an exhaustive explanation, just a really good ...
1
vote
3answers
503 views

Free security audit tool for LAMP server? [closed]

I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it. Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic ...
-3
votes
2answers
103 views

Is it enough just to install LAMP? [closed]

I use yum to install LAMP on Centos, like this: yum install httpd mysql mysql-server php php-mysql chkconfig --levels 235 httpd on chkconfig --levels 235 mysqld on service httpd start service ...
3
votes
1answer
913 views

Jail User to /var/www/username Directory via SSH

I have multiple folders in /var/www for different websites -- Apache uses name-based Virtual Hosts (Ubuntu Server). Suppose I want to allow someone to access their /var/www/user directory, but not cd ...
0
votes
1answer
448 views

Bastille not working on CentOS 5.5 - need fixes or alternatives

After looking into how to prepare my LAMP server for production use, one of the things I saw that was suggested was to use Bastille Hardening. It seems that v3.2.1 is not functioning properly and is ...
2
votes
2answers
449 views

multiuser PHP virtualhosting environment and security

I'd like to setup a multiuser PHP virtualhosting environment. However, here comes my big concern. Users could use the PHP filesystem functions to access the other users directories, thus read the ...
58
votes
5answers
8k views

Tips for Securing a LAMP Server

This is a Canonical Question about Securing a LAMP stack What are the absolute guidelines for securing a LAMP server?
1
vote
2answers
271 views

Are there free secure ways to audit a LAMP's security configs?

Problem is new to LAMP, and want to test the system config in any automated checklist way. Any suggestions?
8
votes
4answers
1k views

VPS Administration for the Absolute Beginner

I have a new site that I want to build, something that I as a programmer wish existed. While there is no way this site would ever reach StackOverflow levels of success, I do hope that it will have a ...
2
votes
1answer
3k views

nikto probe warning messages

I have a pretty standard VPS running Ubuntu 8.1, Apache 2.2, PHP 5 etc. -- standard Lamp stack. I am using suhosin and have tried my best to plug the obvious stuff, since I'm the only user-- there's ...
3
votes
6answers
1k views

Running multiple sites on a LAMP with secure isolation

I have been administering a few LAMP servers with 2-5 sites on each of them. These are basically owned by the same user/client so there are no security issues except from attacks through vulnerable ...
2
votes
5answers
537 views

LAMP Security CentOS

I'm kinda new with servers, but I know my way around. Now I've got a server configured, only I'd like to know if this setup is safe for production use, or if I could do some things better. OS: Centos ...
5
votes
3answers
499 views

How do you know if your Apache Install is Secure?

I'm a hobbyist IT guy and I am running my own Ubuntu server to serve up my website. I was wondering if there are any good ways to find out how secure my setup is, as I'd really prefer not to have my ...
2
votes
7answers
3k views

Should databases containing customer information go in a DMZ?

We're deploying a simple newsletter webapp on a stand-alone LAMP platform in the company DMZ. There is some discussion as to whether the MySQL server should be removed from the DMZ and put in the ...
3
votes
3answers
943 views

How can I get LAMP up and running with Debian?

I need to install Debian for a webserver on a dual-Xeon machine, and it must be as "secure" as possible, with whatever programs and features are available (Firewall, Antivirus, etc). I need basic ...