Securing a Linux Web Server in 10 Steps or Less
Akash Mahajan
@makash
Learn the basic approaches to securing linux based web servers without getting too technical. This talk will be useful for anyone running a linux server with full root access.
You don’t need to be an experienced system administrator to understand and use the content of this talk. But if you are a full time system admin you will get to know a structured way of looking at server security.
The following types of servers running Linux
Virtual Private Server/Dedicated Server/Rackspace Cloud Instance/Amazon EC2
Not going to help if you have your website on Shared servers like
Dreamhost/Go Daddy/Host Gator
Outline
You will learn the holistic way of securing a linux server which can serve web sites. The 80/20 rule about hardening your linux web server with minimal effort.
*In Brief This is what we will cover *
- Reducing the attack surface.
- Patching and Updates
- Securing Secure Shell Access
- Securing Apache
- Securing MySQL
- Logging and Monitoring
- Setting up a basic firewall
Not going to be covered ( Mostly because of lack of time and ROI )
- Securing Email Servers
- Setting up VPNs
- Protecting Against Denial of Service Attacks
- Setting up SELinux, GRSec, Custom Kernels
- Chroot Jails
- DNS Server
Not Going to Discuss
- Why Ubuntu and why not <INSERT FAV. DISTRO>
- Why Not BSD
- Why Apache and why not <INSERT FAV. WEB SERVER>
Requirements
Mandatory
An open mind, a sense of humour.
Good To Have
- Bring a laptop running Ubuntu Server 10.04 LTS if you want to try out things.
- Refresh your understanding of the TCP/IP Stack
- Get a notebook to take notes
- You should have some idea what the following words mean
SSH, Apache, Web Server, Database Server, MySQL, BASH, Command Line
Speaker bio
I freelance as a Web Security Consultant. I help companies become secure by helping them understand approaches to security for servers, web applications, user data and sometimes their network.
Among other things I am the co-founder+Community Manager for “null - The Open Security Community” and OWASP Bangalore
- Website | @makash | Linkedin | Slideshare
Links
- Checklist/Workbook you can use.
- http://www.slideshare.net/akashm/checklistforsecuringlinuxwebserverin10stepsorless
- Download PDF from
- http://dp7937fi8z10f.cloudfront.net/Securing-Linux-Web-Server-in-10-Steps-or-Less.pdf
- https://help.ubuntu.com/community/Security
- https://help.ubuntu.com/10.04/serverguide/security.html
- http://www.yolinux.com/TUTORIALS/LinuxTutorialInternetSecurity.html
- https://benchmarks.cisecurity.org/tools2/apache/CIS_Apache_HTTP_Server_Benchmark_v3.0.0.pdf
- http://akashm.com
- http://linkd.in/webappsecguy
Slides
http://www.slideshare.net/akashm/securing-a-linux-web-server-in-10-steps-or-less
{{ errorMsg }}