This question already has an answer here:

There is a web server installed as a virtual machine in the cloud. I've configured it myself, and it has two corporate web sites on it. I'am not planning anything else to be there. So before it goes to public I want to check it for security vulnerabilities. Pleas guide me to best practices, checklists and audit procedures, anything to measure and evaluate security of the server.

marked as duplicate by Iain, Chopper3, Michael Hampton Jul 3 '13 at 9:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


From a network security point of view you can do the following:

  1. make sure that the server is fully patched. I cannot stress that enough.
  2. make sure that you do not expose any unnecessary services to the outside world, hopefully only port 80 will be exposed.
  3. run a vulnerability scan, such as Nessus or OpenVAS against the server. There are a lot of security tools that can help you with vulnerability scanning. Review each finding and apply countermeasures if necessary
  4. Disable what you do not actually need, reducing your attack surface.
  5. Enable SELinux if not already enabled

The application security side of things is a completely different story, you do not provide any information about it so the usual caveats apply.

  • I'd also enable SELinux, since this is on a CentOS server. – Petter H Jul 3 '13 at 7:44
  • is it not enabled by default on RHEL-like systems? – thanasisk Jul 3 '13 at 7:46
  • why was I downvoted? – thanasisk Jul 3 '13 at 7:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.