2

I am recently running a web server, and there is a lot of information online, but it can all be a little confusing. I recently opened my logwatch logs and saw that i get attacked a lot by all sorts of bots.

Now I am interested in a list with things I definitely should be aware of nowadays, and possible ways to prevent them. I have read stories about server crashed by floods, crashed by email, and all sorts of crazy stuff.

Thing I already did:

  • I have recently blocked all my ports, except for the http and email ports.

  • I disabled IPv6, this was giving me a lot of named errors

  • I have turned on spam DNS blackhole lists to fight spam
    - sbl.spamhaus.org;
    - zen.spamhaus.org;
    - b.barracudacentral.org;

  • I installed and configured mod_security2 on apache

  • There is no remote access possible to my databases

That is all i did so far, further I am not aware of any other threats. I want to know if the following things have to be protects.

  • Can I be flooded by emails. How can i prevent this
  • Can there be a break in or flood of my databses
  • Are there things like http floods or whatever
  • Are there any other things i should know before i go public with my server

I also want to know if there is some kind of checklist with must-have security protections. I know the OWASP list for writing good web applications, is there something for configuring a server.

Improve this question
2
  • 1
    You might want to break these up into multiple questions. These are very open-ended topics that can't really be done justice here.
    – Rugmonster
    Mar 24, 2010 at 5:01
  • I will do that.
    – Saif Bechan
    Mar 24, 2010 at 5:26

3 Answers 3

Reset to default
3

Can service X be flooded?

Yes. You have to ensure the services are configured such that if they do get flooded, your system's resources (CPU, memory, etc) won't be overcommitted. Since you're using mod_security, I assume you're running Apache and MySQL.

For Apache, you'll want to look at the average memory utilization for each Apache process. Adjust the MaxClients setting so that...

MaxClients * Average Memory Utilization < Total Physical Memory - System Overhead

If the DB service is on the same system, then you'll need to account for that. If you are using MySQL, a friend of mine wrote MySQLTuner. While certainly not a be-all-end-all, it will give you a starting point for adjusting your MySQL configs to fit your memory constraints.

With MySQL/Apache, you'll need to ensure you let those run at a normal load for a day or two so that memory utilization stabilizes to what you would consider a normal production level. You'll also need to monitor the system as time goes by as changes to your code and increases in traffic will have various effects in your resource utilization.

All of this is less security related as it is service availability related. In most cases, security isn't that hard. Keep your stuff patched, use good passwords, don't stress out. More times than not, it's going to be the brute force stuff that kills you and with proper resource planning, that can be mitigated to some extent.

Improve this answer
1
  • Nice statements made. I will keep them in mind and read trough the tuner.
    – Saif Bechan
    Mar 24, 2010 at 5:19
0

I agree with Rugmonster, but, for some casual reading. ;)

http://msdn.microsoft.com/en-us/library/aa302351.aspx http://windows.stanford.edu/docs/IISsecchecklist.htm

Improve this answer
0

I answered a similar question with some general security best practices here:

Secure LAMP server for production use

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .