Language Selection

English French German Italian Portuguese Spanish

Quick Guide to Securing a Lamp Server

Filed under
Howtos

In the last few years on the Internet the price of dedicated servers have went down and more people are beginning to use them for their sites, game servers, or small hosting companies. With this comes as I was talking about in my last article inexperienced admins. Lots of people I spoke too are too intimated by the linux shell and try to administer their server completely from the control panel.
This short guide will show you a few copy and paste walkthroughs you can use to help secure your server, these should work with any control panel, the mod security update script however is only for apache2. Using these tools and using basic security procedures will help you keep your server secure and free of hackers, spammers, and other annoyances.

Using linux as a personal desktop helps a lot as well as it gets you used to using the command line. The other extremely valuable tool is google. I would probably be nowhere without google. You can look stuff up as you go and find about any answer to any question you may have, Plus there is lots of walkthroughs just like this one I am just putting all the basic ones together.

OK this is not a complete guide but those who are less experienced should be able to follow these walkthroughs and make their server more secure then it was before.
First thing, install apf, bfd, and dos deflate. Complete walkthrough HERE
Note: Dos deflate will not work with debian unless you disable ipv6.

Next install modsecurity using the simple guide from eth0.us, guide can be found HERE

After you install mod security make a directory in /etc called modsecurity. Use my update script found HERE (apache2 only)
This will get all the latest rules from gotroot.com when you have them at the bottom of the mod security configuration in httpd.conf put
Include /etc/modsecurity/apache2/rulename.conf
I suggest using them all besides rules.conf as it gives lots of false positives.

Now if you have shell users or are running redhat, fedora, or debian you most likely need to update your kernel. Now this isn't as hard as you would think, with this copy and paste guide I made that is all you have to do is copy and paste, same as these other tutorials.
The guide can be found HERE. I will be making one for debian soon but you just use any basic debian kernel how to and patch the kernel the same way as you do in this one.

Once you have modsecurity installed keep an eye on the audit log to make sure it is not giving any false positives or blocking legitimate web apps. With the ruleset and rules you have included it should not unless someone is using some oddball web app.
None of these will make your server totally secure, it takes basic security practices such as using strong passwords, not using the same password for everything, and keeping up with all the latest exploitrs and hacking methods.

If you ever get hacked don't go ranting about how you are gonna prosecute so and so, go find out how they done it, how they got in, and what you can do to prevent it again. You will most likely never track down the hackers and the FBI most likely will not care so secure your system and make sure it does not happen again. As I have explained before defacers can actually be helpful to admins. That's about it, good luck and stay on your toes.

More in Tux Machines

Graphics: Chai, Nouveau, Mesa and More

  • Development On The Chai Mali T700 Open-Source GPU Driver To Resume
    Last year we covered the work on the project "Chai" as an open-source, reverse-engineered driver for Mali T700 series. After a hiatus, the lead developer is back working on the project. The developer on the project was previously just known as "Cafe Beverage", but this developer has come out today as Alyssa Rosenzweig.
  • Nouveau's NIR Support Inches Closer To TGSI Quality
    Longtime Nouveau contributor Karol Herbst joined Red Hat at the end of last year where his current task is on NIR intermediate representation support for Nouveau as part of bringing SPIR-V compute support to this open-source NVIDIA Linux driver.
  • Intel GLSL On-Disk Shader Cache Enabled By Default
    For Mesa 18.0 is the initial Intel shader cache support for archiving compiled GLSL shaders on-disk to speed up the load times of subsequent game loads and other benefits. For the Mesa 18.0 release the functionality isn't enabled by default but it will be for Mesa 18.1.
  • Xorgproto 2018.3 Brings RandR Leasing + Non-Desktop Monitors
    Xorgproto debuted earlier this month as a centralized package of all X.Org protocol headers that used to be versioned and developed independently. Given the slower development now of the xorg-server and lots of the protocols being intertwined, they are now all bundled together. Tuesday marked the 2018.3 release with the new additions for Keith Packard's SteamVR Linux infrastructure work. Xorgproto 2018.3 offers up the protocol changes for the X.Org Server work that Keith Packard has been doing on improving the virtual reality head-mounted display (VR HMD) support for Linux systems, particularly around SteamVR. The X.Org protocol changes needed are supporting RandR leasing of outputs and also non-desktop monitor handling, so the VR HMD won't be treated as a conventional display and the Linux desktop systems then attempt to make use of it thinking it's just another HDMI/DP display.
  • Even With AMDGPU DC, HDMI/DP Audio Isn't Working Out For All Radeon Linux Users
    While the newly-released Raven Ridge APUs could make for nice HTPC systems given the number of compatible mini-ITX/micro-ATX motherboards and these 65 Watt APUs offering Zen CPU cores with Vega graphics, besides the current problematic Raven Ridge graphics support, there are still some broader AMDGPU DC audio problems for newer graphics cards. Phoronix reader Fred wrote in today to call attention to the AMDGPU DC audio situation. While AMDGPU DC was merged in Linux 4.15 and provides HDMI/DP audio support to the past few generations of Radeon GPUs on this new display code stack, not all audio formats play nicely.

Open source RISC-V architecture is changing the game for IoT processors

Over the past decade, open source software has been one of the biggest catalysts in the tech world. Today, the power of open source, the freedom it enables, and the communities that it generates are gaining traction in the hardware world too. For these reasons, RISC-V is gaining huge popularity. Here is an introduction to RISC-V and the opportunities it opens. Read more Also:

Security: Updates, Tesla, Chef, SafeRide and More

Games Leftovers