0

There is a web server installed as a virtual machine in the cloud. I've configured it myself, and it has two corporate web sites on it. I'am not planning anything else to be there. So before it goes to public I want to check it for security vulnerabilities. Pleas guide me to best practices, checklists and audit procedures, anything to measure and evaluate security of the server.

Improve this question
0

1 Answer 1

Reset to default
2

From a network security point of view you can do the following:

  1. make sure that the server is fully patched. I cannot stress that enough.
  2. make sure that you do not expose any unnecessary services to the outside world, hopefully only port 80 will be exposed.
  3. run a vulnerability scan, such as Nessus or OpenVAS against the server. There are a lot of security tools that can help you with vulnerability scanning. Review each finding and apply countermeasures if necessary
  4. Disable what you do not actually need, reducing your attack surface.
  5. Enable SELinux if not already enabled

The application security side of things is a completely different story, you do not provide any information about it so the usual caveats apply.

Improve this answer
3
  • I'd also enable SELinux, since this is on a CentOS server.
    – Petter H
    Jul 3, 2013 at 7:44
  • is it not enabled by default on RHEL-like systems?
    – thanasisk
    Jul 3, 2013 at 7:46
  • why was I downvoted?
    – thanasisk
    Jul 3, 2013 at 7:58