Member Avatar for Octet

I know this question is extremelly hard to answer without actually checking how I setup my server, but I wondered if anyone could give me a quick rundown and/or information as to how I could check and protect it further.
I am running a Web Hosting Server using old computer components, the server runs Ubuntu 11.10 Server Edition and automatically updates.
I am also running the Linux Firewall and a seperate firewall package. I only allow Ports 22 and 80 to be accessed.
The server is connected via ethernet to my router which also has it's own firewall and again, only allows ports 22 and 80 and when those ports are accessed it points it to the server.

I am running a MySQL database and I have placed various anti-SQL Injection lines into my site to prevent people from infecting the database.


Can anyone else suggest what I can do to further improve security, rate my security and/or tell me what sort of damage they can do if someone got in? When I say this, I primarily mean to other machines on the network as opposed to the server itself.


Thank you

  • 4 Contributors
  • 3 Replies
  • 275 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

Quick, practical assessment for 's setup: the single biggest risk is the operating system. Ubuntu 11.10 (Oneiric) reached end-of-life on May 9, 2013, so it no longer receives security patches; an internet-facing host running an EOL distro is exposed even if only ports 22 and 80 are allowed. Upgrading to a currently supported release (or rebuilding on a supported LTS) is the highest-priority remediation. (fridge.ubuntu.com)

Network and service checklist (build on 's nmap suggestion): verify what is actually listening and which versions are exposed, then remove or stop any nonessential services. A useful quick audit command is:

nmap -sS -sV -Pn -p 22,80 <server-ip>

Harden SSH (disable root login, require key auth, limit allowed users), and add an automated ban tool such as fail2ban to throttle brute-force attempts. Scanning tools should only be run against systems owned or authorized to test. (nmap.org)

Application and database hardening (expand on and ): web apps are the most likely compromise path—SQL injection remains a top application risk. Use parameterized queries/prepared statements, strict input validation, least-privilege DB accounts, and bind MySQL to localhost or an internal network. Run the bundled hardening helper:

sudo mysql_secure_installation

Remove test databases/accounts and avoid running the DB as a publicly reachable service. (owasp.org)

Operational controls: add a WAF (ModSecurity + OWASP CRS) to catch common HTTP attacks, centralize log collection/alerts, keep regular, tested backups, and schedule periodic external scans and dynamic app testing (RatProxy or other scanners were mentioned in the thread). These layered controls reduce risk even if one defense fails. (owasp.org)

Recommended Answers

All 3 Replies

Member Avatar for cereal

In addition search for "MySQL hardening" to enhance MySQL config and try RatProxy to test your application:

Member Avatar for rubberman

In my experience, your basic configuration at process is solid. However, you need to make sure that your web applications are not susceptible to SQL injection attacks. That is likely your most vulnerable point of system compromise.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.