2

I am recently running a web server, and there is a lot of information online, but it can all be a little confusing. I recently opened my logwatch logs and saw that i get attacked a lot by all sorts of bots.

Now I am interested in a list with things I definitely should be aware of nowadays, and possible ways to prevent them. I have read stories about server crashed by floods, crashed by email, and all sorts of crazy stuff.

Thing I already did:

  • I have recently blocked all my ports, except for the http and email ports.

  • I disabled IPv6, this was giving me a lot of named errors

  • I have turned on spam DNS blackhole lists to fight spam
    - sbl.spamhaus.org;
    - zen.spamhaus.org;
    - b.barracudacentral.org;

  • I installed and configured mod_security2 on apache

  • There is no remote access possible to my databases

That is all i did so far, further I am not aware of any other threats. I want to know if the following things have to be protects.

  • Can I be flooded by emails. How can i prevent this
  • Can there be a break in or flood of my databses
  • Are there things like http floods or whatever
  • Are there any other things i should know before i go public with my server

I also want to know if there is some kind of checklist with must-have security protections. I know the OWASP list for writing good web applications, is there something for configuring a server.

  • 1
    You might want to break these up into multiple questions. These are very open-ended topics that can't really be done justice here. – Rugmonster Mar 24 '10 at 5:01
  • I will do that. – Saif Bechan Mar 24 '10 at 5:26
3

Can service X be flooded?

Yes. You have to ensure the services are configured such that if they do get flooded, your system's resources (CPU, memory, etc) won't be overcommitted. Since you're using mod_security, I assume you're running Apache and MySQL.

For Apache, you'll want to look at the average memory utilization for each Apache process. Adjust the MaxClients setting so that...

MaxClients * Average Memory Utilization < Total Physical Memory - System Overhead

If the DB service is on the same system, then you'll need to account for that. If you are using MySQL, a friend of mine wrote MySQLTuner. While certainly not a be-all-end-all, it will give you a starting point for adjusting your MySQL configs to fit your memory constraints.

With MySQL/Apache, you'll need to ensure you let those run at a normal load for a day or two so that memory utilization stabilizes to what you would consider a normal production level. You'll also need to monitor the system as time goes by as changes to your code and increases in traffic will have various effects in your resource utilization.

All of this is less security related as it is service availability related. In most cases, security isn't that hard. Keep your stuff patched, use good passwords, don't stress out. More times than not, it's going to be the brute force stuff that kills you and with proper resource planning, that can be mitigated to some extent.

  • Nice statements made. I will keep them in mind and read trough the tuner. – Saif Bechan Mar 24 '10 at 5:19
0

I agree with Rugmonster, but, for some casual reading. ;)

http://msdn.microsoft.com/en-us/library/aa302351.aspx http://windows.stanford.edu/docs/IISsecchecklist.htm

0

I answered a similar question with some general security best practices here:

Secure LAMP server for production use

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.