Member Avatar for Octet

I have Ubuntu 12.04 installed on my home web server which I am hoping to use to host my website in the near future. Security is obviously paramount, and is my primary concern at the moment.

What is there that can be done to help prevent attacks?
My current setup is as follows:

  • Routers in built firewall, of which only HTTP and SSH (80 and 22) are allowed through which goes directly to the server.
  • Ubuntus UFW is enabled, again allowing only HTTP and SSH.
  • Strong passwords, and encrypted HDD
  • Fail2Ban Intrusion Detection System
  • Security updates released by Ubuntu

  • Disabling Root SSH Login

  • Restricting access to folders of the site itself

  • Preventing Apache from disclosing information about itself

Is there anything else which I can do to help protect my LAMP and SSH server and from a glance, how secure does it appear?
My guess is that the main problem shall end up being SQL Injection, but still the server needs to be secure.

Thanks

Edited by Octet because: Added additional information.
  • 4 Contributors
  • 5 Replies
  • 346 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by mboelen

Dani AI

Generated

Good baseline — router firewall + UFW, encrypted disk, Fail2Ban and disabled root SSH are all the right building blocks (thanks for the list, ). ’s SELinux idea is valid, but on Ubuntu the practical default is AppArmor; use it to confine services rather than trying to run a full SELinux stack unless you need it. (documentation.ubuntu.com)

Harden SSH properly (keys only, short grace, rate-limit) and test before you lock yourself out. Practical changes in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
LoginGraceTime 20
AllowUsers youruser

Use ssh-copy-id to install keys and keep a fallback session open while testing. Rate-limit with the firewall: sudo ufw limit ssh (or use iptables rules). These steps are standard Ubuntu/OpenSSH hardening practices. (help.ubuntu.com)

Web-app layer: prevent SQL injection at the source — parameterized queries / prepared statements or safe ORM usage is the single most important control for SQLi. Validate and canonicalize input, apply least-privilege DB accounts, and do not build SQL by concatenation. For defense-in-depth add a WAF (ModSecurity + OWASP CRS) to catch common exploit patterns. (cheatsheetseries.owasp.org)

Transport and server-info hygiene: run everything on HTTPS (Let’s Encrypt + Certbot makes certificates free and automatable) and tighten TLS with modern cipher suites. Turn off server signature and reduce server headers to avoid leaking versions (ServerSignature Off / ServerTokens Prod) and add security headers via mod_headers. (github.com)

Operations: enable automatic security updates (unattended-upgrades), run file-integrity and audit tools (AIDE, auditd), maintain off-site backups, and run periodic audits (Lynis was suggested by — run it from a staging VM first). Monitoring and recovery plans are as important as prevention. (documentation.ubuntu.com)

Troubleshooting note: any change that affects authentication or networking can lock you out — always test from a second session or console, and keep an out-of-band recovery plan.

Recommended Answers

All 5 Replies

Member Avatar for rubberman

You can use iptables to further firewall your servers, and enable SELinux extensions (Security Enhanced Linux), which can very much harden your systems. SELinux was originally developed by the US National Security Agency, and is (or should be) used on all high-security government systems.

Member Avatar for Octet

Thank you, looking at SELinux at the moment but all I can find online about it is people wanting to disable it?

Member Avatar for ayush1440

Hi,

I am guesing that you require ssh access from public thats why you open SSH from firewall. I am using DenyHosts for dictionary attack as well as strong security policy. DenyHosts is really very helpful. Also I am using KeePass for making strongest password.

I think that will helpful.

Sorry for bad english.

Member Avatar for Octet

Yep, I do require SSH from public IPs as I could be travelling and so I can't setup a whitelist. I shall look into DenyHosts and KeePass however I think Fail2Ban has a DenyHosts style feature with it. If the password is incorrect three times it shall block the IP.

Member Avatar for mboelen

For people finding this older (useful) thread. I suggest to try my tool Lynis, for hardening your systems:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.