Feedback and comments @makash | akashmahajan@gmail.com

Workbook for http://slidesha.re/JMDS7F Page 1 of 1 ©Akash Mahajan 2012

Securing Linux Web Server in 10 Steps or Less This document is in addition to the slides of Securing Linux Web Server in 10 Steps or Less. Consider this as

a starting block for Linux server hardening activities.

Assumptions You have root access to the Linux server

You are running either Ubuntu 10.04 LTS or above or a Debian variant. If you are using another distribution

like CentOS etc. please understand the reasoning and substitute your commands.

Checklist Reduce the attack surface

Start with a mini distro and add software on top of it.

# tasksel install openssh-server

# tasksel install lamp-server

See which processes are listening on the external IP address

# netstat –nltup -4

Stop or remove services from running or booting up

# /etc/init.d/<service name> stop

# update-rc.d <service name> remove

Stop services from listening on external IP address

bind-address=127.0.0.1

Patch and Update your server

# apt-get update && apt-get upgrade

Secure your access with SSH

Remove Root Login

Ideally use public keys with passphrases

Add another directive in /etc/sshd_config

AllowUsers <user@host>

Secure Apache Web server

In /etc/apache2/conf.d/security

Uncomment line number 27 ServerTokens Prod

Uncomment line number 39 ServerSignature Off

Keep file owner as the user which uploads and group as www-data

Secure MySQL if database server and web server are on the same host

In /etc/mysql/my.cnf

bind-address=127.0.0.1

Execute following command

# mysql_secure_installation

Create a new user for each new database and only give access to the following

SELECT, INSERT, UPDATE, DELETE, ALTER, CREATE

Specify the host where the user can login from. Ideally this should be localhost and never ‘%’

Enable Uncomplicated Firewall

ufw allow

ufw allow <Ports you want>

ufw default deny

ufw allow from <external IP> to <current host IP> port 3306