15 ms·

How to set up a safe and secure Web server

345 points by chinmoy 14y ago

jiggy2011 14y ago
It's also a good idea to install (and configure) at least some basic IDS like tripwire. You should probably have it do checks on a cron job as well as doing chkrootkit. Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them. Also if you have multiple web apps running, chroot them if at all possible so that if something does break out it can't (so easily) wreak havok over your entire filesystem. If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily. I also didn't see mention of an update strategy for security updates. You can use apticron to email you with which updates are available and which are important for security. You can set updates to go automatically (I recommend security only) but if you are more cautious you might want to test on a VM first. But keep an eye on them! This is very important, especially if you are managing wordpress etc through apt. And so many other things that I have probably forgotten. Having some form of audit (that tripwire can provide) is vital in those "oh fuck" moments where something doesn't seem quite right and you start wondering if you have been pwned but have no real way of actually knowing.
- colonelxc 14y ago
  > If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily. I'm slightly confused by this, within the context of this article. Yes, /tmp is readable and writable by all, but that doesn't mean that everything in it is readable or writable to other people. The sessions that PHP creates will be owned by the webserver user (nobody/www-data/something else), and shouldn't be readable or writable by other users. This is still a problem with shared hosting, where you might have multiple websites running on the same server. One shared host would be able to read another's sessions, because they are all running under the webserver's user. This[1] suggests overriding the session_set_save_handler and writing to a resource that only you control, such as your DB. [1] http://phpsec.org/projects/guide/5.html http://phpsec.org/projects/guide/5.html
  - jiggy2011 14y ago
    Yes, that's precisely what I meant. I shouldn't post when I'm tired :)
- spindritf 14y ago
  > You should probably have it do checks on a cron job as well as doing chkrootkit. http://securityreactions.tumblr.com/post/36736148501/rkhunter-1-2-5-running-every-night-as-the-cron-job http://securityreactions.tumblr.com/post/36736148501/rkhunte... I know it's a meme-grade blog but it really fits.
JoeCortopassi 14y ago
For anyone that wants more resources like this, I've found articles in Linode's library to be very helpful: http://library.linode.com/lamp-guides http://library.linode.com/lamp-guides
- therealarmen 14y ago
  I live (and die) be these guides.
  - circa 14y ago
    haha! yes me too. so great!
- WickyNilliams 14y ago
  Thanks so much for these links. Got a server coming for Christmas (best present evah!!1!) and was worried that I'd get completely lost trying to configure it blindly. Will definitely refer back to these on that jolliest of days
leadholder 14y ago
I recently worked on a site run on such a server. I've set up my own servers before, and I think it can be fun, but this time it was the other guy's. I have to say it was pretty annoying because the little things that were not set up properly added up to a website that wouldn't deliver email, a shell environment with awful defaults...yuck. There was a lot of maintenance that was ignored because the guy just didn't have the time. Well, that's what commercial web hosts are for. It's amusing to think that some overburdened IT guys believe they're doing their clients a huge favor by running a vanilla web server in their network closet.
deleted 14y ago
[deleted]
jkuria 14y ago
Frankly, articles like these are a deterrent to all but the most techie of people. Why go through all this and shell $270 when you can get an Amazon EC2 instance free for a year!
- chewxy 14y ago
  Did you read the article? You still need to setup nginx or apache or whatever on EC2. Page 2 onwards actually deals with these things
  - pan69 14y ago
    Yeah. So why pay $270?
    - rburhum 14y ago
      Perhaps you need storage in terabytes for something. 12TB on your own machine is relatively cheap. On AWS, not so much. Read speed is another factor.
- Stealth- 14y ago
  As far as being "the most techie of people", this article is actually quite basic and gives a very easy introduction.
- thedufer 14y ago
  Honestly, its a much easier setup on your own box. You have the option of a GUI, and I've found installing a linux distro on my own box to be much easier than figuring out EC2.
  - BigRedS 14y ago
    I'm not sure where a GUI comes in handy here - it's not like there's any good GUI (in the traditional sense) tools for fiddling with webserver config. Even were I to want one on a webserver on the localhost I'd probably just install webmin or something, which you can do equally well on a VM somewhere else.
quandrum 14y ago
I think it's time articles like these start suggesting an infrastructure as code product, like chef or puppet, to do the heavy lifting. I feel like doing this stuff by hand should be considered insecure and outdated..
- mrkurt 14y ago
  All chef and puppet give you is a tool to setup 100 insecure and outdated servers, they don't help at all with the initial security decisions.
- EricDeb 14y ago
  Any other tools or resources you'd recommend to a newbie web server admin? I've checked out a few books but it's hard to know what's being used in industry.
  - buster 14y ago
    I'd recommend puppet or ansible. http://ansible.cc/ http://ansible.cc/ http://puppetlabs.com/ http://puppetlabs.com/
- calpaterson 14y ago
  If you don't know how to do it by hand, then puppet is just going to confuse you. Better to keep it simple when you're new at something.
hardik988 14y ago
Pardon my stupidity, but how would one go about getting an IP address for a server installed at home? Is it a static IP address provided by my ISP, or something else ?
- ceol 14y ago
  If you have a dynamic IP, Dyn offers DNS services[0] that let you tie a domain to it through them. I believe it requires you to install something on your machine that monitors your IP and reports it back. Otherwise, you just use your IP and make sure to edit the DNS yourself when it changes. [0]: http://dyn.com/dns/ http://dyn.com/dns/
  - kysol 14y ago
    That would be something like: http://dyn.com/support/clients/linux/ddclient/ http://dyn.com/support/clients/linux/ddclient/
  - Stratoscope 14y ago
    Many routers have dynamic DNS support built in now. For example, my Asus RT-N66U supports several DDNS services including Dyn and a free one that Asus provides for its router customers at {yourcustomsubdomain}.asuscomm.com. No big surprise here, since the router is really just a nice little Linux box.
    - ceol 14y ago
      Ah, I have an Asus RT-N16. DD-WRT is truly awesome!
- stephen_g 14y ago
  By your ISP. Some plans come with a static IP by default, but many providers make you pay extra (or go onto a business plan if you tell them you want to run servers)
- politician 14y ago
  The messages that your computer sends to the internet include an IP address which the internet uses to send responses back to your computer. The problem is that these addresses are unstable -- your ISP reserves the right to change it, basically. If you want to host a server from home, you have a few choices: a) Obtain a static IP address from your ISP. b) Obtain a domain name from a dynamic DNS provider and map that to your current IP address. Update the mapping as necessary. c) Just use your existing IP address -- this is how P2P or Skype works, for example.
zdw 14y ago
Better hardware would be an HP Microserver (which should win the contest for "worst URL ever"): http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-4237916-4237918-4237917-4248009.html?dnr=1 http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-42... Has ECC RAM support. Takes 4 3.5" hard disks, and runs very quiet and cool.
- da_n 14y ago
  That is a truly frightening URL, makes me wonder what kind of CMS they are running that generates 100 character long URI (Vignette?).
  - thejosh 14y ago
    The HP Blog URLs are scary as well..
  - pooriaazimi 14y ago
    This is the scary part IMO: http://h10010.www1.hp.com http://h10010.www1.hp.com - If you go to http://www.hp.com/xxxxxx http://www.hp.com/xxxxxx (the rest) or even http://h10010.www.hp.com/xxxxx http://h10010.www.hp.com/xxxxx, it's a 404. Even worse: curl http://www1.hp.com curl: (6) Could not resolve host: www1.hp.com; nodename nor servname provided, or not known
- sliverstorm 14y ago
  I looked at getting one of those. However, it seems like HP is sunsetting the Microserver line, which is a real shame.
  - kryptiskt 14y ago
    Which is a good reason to get one now. I have one (running FreeBSD and ZFS), and it has been great. I does what I ask of a homeserver: it runs silently and is pretty good at saturating a 1Gb connection, the RAM really helps the performance. All at a great price.
    - 14y ago
barefoot 14y ago
"...being locked to IIS as a Web server (or dependent on crippled Windows ports of better Web servers) means you'll be playing in the bush leagues. IIS is found running many huge and powerful websites in the world, but it's rarely selected in a vacuum..." I sense a little bit of bias. As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is a first class framework and many prefer it over other popular alternatives on other platforms such as Django, Rails, and Cake. In addition, Visual Studio is arguably the best IDE available and publishing to an IIS server is dead simple. As for cost, full versions of Visual Studio and Windows Server can both be obtained for free through the DreamSpark program for college students and through the similar BizSpark program for startups and small businesses.
- stephen_g 14y ago
  Do those versions let you use the products on production web servers though?
  - sliverstorm 14y ago
    Isn't that what "full versions" means?
    - Pwnguinz 14y ago
      Not sure if you're being sarcastic or not, but "no". Whether or not a particular software can be used in a commercial context has more to do with licensing than how "full version" it is. In fact, even Trial versions of softwares can often be used in a commercial context during the trial period. Versus, say, the full version of VMware Player, which while full featured and having no trial period, is prohibited via license to be used commercially.
  - Encosia 14y ago
    Yes.
- hristov 14y ago
  I tried to read the Bizspark FAQ, and now my head hurts. But anyways, what I think I was able to get out of it is that: 1. You have to apply. 2. You have to be approved, which takes a minimum of 5 business days, and you may not get approved. 3. At some point you "graduate" and lose your licenses and have to pay for software. The faq does not say when this graduation happens, but I seem to remember hearing something about 6 months. So, no it is not really free. And it is definitely harder to get it than simply typing: sudo apt-get install apache2
leeoniya 14y ago
knockd + fail2ban + iptables http://howto.biapy.com/en/debian-gnu-linux/system/security/harden-the-ssh-access-security-on-debian http://howto.biapy.com/en/debian-gnu-linux/system/security/h... also, chrooted sftp-only accounts http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP#Chrooted_SFTP-only_Accounts http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP#Chrooted_...
- shy_coder 14y ago
  http://configserver.com/cp/csf.html http://configserver.com/cp/csf.html Another solution that is much easier to configure compared to iptables/fail2ban.
buster 14y ago
Ah well, it's rather a "how i set up a small web server for fiddling around with stuff" not so much a professional article about security. Sorry, but the first page is like "mhh, yeah, geeks hate MS, let's use the other choices" under the hood. Why? Because it doesn't really mention a technical choice against MS. Don't get me wrong i would never ever use Windows Server but when i'd write such an article i'd have to find at least a few technical pros and cons for the choices i preset. "Uhhh, the internet is more like a unixy thing" doesn't cut it. This goes on with the choice for Ubuntu Server. Why? Is it an article about "safe and secure web server" or about "how does my grandma set up a server"? There are much more choices in terms of reliability and proven track record like FreeBSD, OpenBSD, Debian, RHEL/CentOS. The choice was made because it's easier to set up and apparently the author is too lazy to _really_ do his homework. In the end, i'd say if the articles title would be "beginners guide how to setup a server" i wouldn't comlain..
- mylittlepony 14y ago
  As a professional developer and amateur sysadmin, I have to say Ubuntu is a great choice, and I will never use CentOS again. The main reason being how updated packages are in Ubuntu, and outdated in CentOS. I don't know about the other options.
  - buster 14y ago
    I would much more care for timely security updates. Servers are the parts where you don't need the latest software, in my opinion. Not if it comes for less stability or security. In the best case i have a very secure default installation, install the software i need from updated repositories, let the server update itself (or let it remind me of updates) and be gone with touching the shell ever again. The goal is to have the server running safe and secure for years and not to have the latest pre-beta release versions of NoSQL-engine XYZ "just because". Personally on my Desktop i have been a Debian guy (and after that Ubuntu), but it all depends on the requirements. My personal view: - my personal server runs Debian but i would place ubuntu a second for a one-person thing with no personal data on it. I know it runs a stable and updated OS and it just runs and runs and runs. You need a newer software version? You can selectively take some from testing or even unstable if you have to. You still get timely updates and live in an eco-system that is largely seen as proven, stable, excellent. Ubuntu (afaik) only get's Debian testing packages anyway, but still needs to patch them or tweak them. Or you get non-upstream packages. Also my experience is that Debians configuration is quite secure by default. Whereas Ubuntu tries to make it easy for you but also more open to security flaws. - for an enterprise i can totally see why many choose RHEL (because of support, fast security updates and great in-house know-how. Do you know how many kernel developers are employed by Ubuntu? You don't want to know.. I give a lot of Kudos to RedHat for being such an open and contributing company.) - for a start-up i can totally see how FreeBSD might fit as an internet-facing frontend. It's a stable and fast workhorse, and you'll end up compiling, configuring, installing the core components of your system all the time anyway. Talking about it i feel a bit sad of not mentioning Solaris anymore. Solaris "was" awesome.
hakaaak 14y ago
http://stackoverflow.com/questions/72394/what-should-a-developer-know-before-building-a-public-web-site http://stackoverflow.com/questions/72394/what-should-a-devel... can't believe that hasn't been on HN before, so added it: http://news.ycombinator.com/item?id=4841329 http://news.ycombinator.com/item?id=4841329
- nimrody 14y ago
  What is really amazing is that these sort of questions (and detailed answers) are not welcome on StackOverflow: Locked: "This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: FAQ." At least the list of references there is useful.
Jailout2000 14y ago
What a bias. Using Debian and not even mentioning forks like Red Hat. Downvoted, never recommend.
babarock 14y ago
Am I the only one who thinks that SSD are useless since most of the time the processing will be bottlenecked by the network overhead?
- jbri 14y ago
  Unless you're purely serving static content, network bandwidth is not going to be your bottleck. That's not really the point though, since the big motivator for SSDs isn't bandwidth, it's latency.
- bad_user 14y ago
  Network overhead is just one bottleneck. A harddisk seek + reading 1 MB sequentially is something like 30 times slower than SSD and 120 times slower than reading from RAM. Disk seeks are what really kills you, as a disk seek is 20 times slower than a roundtrip within the same datacenter. Sending 1 MB of data over a 1Gbps network using a disk seek and a sequential read is 3.6 times slower than doing the same with SSD. For big files with a server that has to serve many concurrent requests you'll end up doing several disk seeks for the same file. And we've been talking about the ideal too, because data on disks can get fragmented and so reading from the same file does not guarantee a sequential read. This is why Varnish does caching, even when serving static files. If you want high performance with low latency, then Varnish works better than something like Nginx. As an example, right now I'm working on integrating with an OpenRTB ads exchange platform. My server has to respond within 100ms total roundtrip (with an upper bound of 200ms, but they complain if you consistently respond in over 100ms). It's enough to say that everything to be served has to be already in memory, as doing anything else means that window cannot be met (consider how a single disk seek can cost something like 10ms). So yeah, SSDs can be useful.
  - babarock 14y ago
    Thank you for the explanation.
dschiptsov 14y ago
Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we need less code, integrated with OS, not more "isolated" crapware which needs networking, AIO and really quick access to the code from shared libraries. And, of course, a setup without middle-ware (python-wsgi, etc) and several storage back-ends (redis, postgres) is meaningless. Update: Well, production is not about having a big server which is almost always 100% idle, and can be partitioned (with KVM, not a third-party product) to make a few semi-independent virtual servers 99% idle. This is virtual, imaginary advantage. On the other side, your network card and your storage system cannot be partitioned efficiently, despite all they say in commercials. And that VM migration is also nonsense. You are running, say, a MySQL instance. Can you migrate it without a shutdown and then taking a snapshot of an FS? No. So, what migration you're talking about? It is all about your data, not about having a copy of a disk-image. It is OK to partition development, or 100% idle machines - like almost all those Linode instances, which have a couple of page request in a day - this is what it was made for, same as old plain Apache virtual-hosting. But as long as one needs performance and low latency, all the middle-men must go away.
- te_chris 14y ago
  How is this the top comment? I'm sure some of your points may be salient, but practical experience says virtualization works just fine for production. Same with the JVM.
  - dschiptsov 14y ago
    1. at what cost? 2. just fine is not enough. 3. for some reasons all sites uses nginx, not jetty.)
    - lemieux 14y ago
      Nginx and jetty are not the same thing. Nginx is a web server optimized to deliver content. Jetty is an application server built to run the applications. Both can be used together. Also...Is Amazon EC2 considered virtualization for you?
tzaman 14y ago
This article would make a really nice screencast that would be much more useful to newbie sysadmins.
- e12e 14y ago
  How would a screencast be more useful?
  - drudru11 14y ago
    not sure, but I wanted to say thanks for the C as a functional language links you replied with earlier. Comments are off after 14 days so I couldn't say thank you there. The closest was the function pointer one, but it still wasn't the one I remember.
  - tzaman 14y ago
    It's much easier to see the workflow and listen to someone speak, than read a complex article.
    - e12e 14y ago
      sounds like an argument for a simpler article. I agree, the article is rubbish.
rlpb 14y ago
If you want a safe and secure Web server, use what your distribution gives you. Don't add third party sources if you can avoid it, ie. don't need features < 1 year old. It's hardly safe and secure if it's not had long enough for people to find problems with it anyway. Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get all your updates in case fixes are needed. If you start adding third party sources, you're on your own as to managing any implications of the way you've put it together. Just because each individual component is safe and secure doesn't mean that it is as a whole. For example, Ubuntu add hardening (AppArmor) for various server daemons which you won't get if you just download apache from the project website. If you need a guide on putting a system together yourself, then you aren't someone who can manage these implications yourself, and you're trusting the guide author in not having made any mistakes. Are you really in a position to judge his competence? Just use your distribution's standard web server and you'll get your safe and secure Web server in one command.
- laumars 14y ago
  I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as unauthorised files in Apache config 6-> same as above for editor specific back up files (eg file~). But this is only an issue for people who bulk upload or edit files on the live server (very naughty). 7-> having less optimal SSL configurations (Apache's default SSL set up isn't PCI compliant). (IIRC there's a couple of other Apache tweaks, but that's just off the top of my head) Then you have issues with PHP (eg logging to STDOUT so web users can view PHP errors). And that's just covering the webserver configuration. There's still holes that need plugging if you actually want to run a secure web server; one of my favourite tools for that is using fail2ban which will auto-blacklist IPs in iptables (Linux firewall) based on if certain attacks are detected. For example it can prevent brute force attacks on SSH brute force attacks (which negates the need to run denyhosts as recommended in the article), HTTP auth, FTP, mail servers, etc. And touching on SSH, many data centres will enable root log ins on their OS pre-installs by default. Your first job on any such box will be creating a user account and then disabling root log ins (PermitRootLogin no -> /etc/ssh/sshd_config). Then there's a whole stack of optimisations you can run on iptables to adaptively prevent port scanning, forged TCP/IP packets and such like. Also many distributions ship FTP, which is insecure by default. Anyone sys admin requiring FTP hosting would be better off using a chrooted SFTP environment (so the security benefits of SSH plus the sandboxed (chroot) environment that FTP often benefits). Let's also not forget the plethora of internal services (databases, MTAs (mail servers), etc). If you're reading this article then you're probably not a trained systems administrator or not working for a large enough company where each server is running in it's own environment. Thus your MySQL / Postgre / whatever databases are running on your webservers. So you need to ensure that your database is only listening on localhost (127.0.0.1). Same applied for your MTA, unless you are intentionally providing a mail services (it is advisable to have an MTA installed even if you're not providing mail services because you can then set up daemons like fail2ban to automatically e-mail you when attempted break ins happen; which will in turn allow you to spot any determined hackers and permanently ban their IP from your box). And lastly, if you're really paranoid, run your webserver inside a Linux/UNIX container (FreeBSD Jail, Solaris Zone, Linux OpenVZ) instead of inside a virtual machine as there have been hacks where attackers can break out of the VM and gain access to the host system (as of yet, I've not heard such attacks from containers, but if anyone has any evidence of that then I'd love to know). Running inside a container will give your webserver the sandboxed environment to work with plus an easy route for backups / snapshotting meaning minimal downtime and data loss should the worst happen and your server does become compromised. (source: http://www.youtube.com/watch?v=hCPFlwSCmvU http://www.youtube.com/watch?v=hCPFlwSCmvU - it's a plugged vulnerability, but it will give you an idea about the kind of issues VMs face when compared to containers) In short; distribution's don't ship secure defaults. They ship a happy medium between usability and security. However if you have an internet facing box (particularly one not hidden behind a hardware firewall, as many budget set ups are not), then the happy medium isn't secure enough.
Charlesmigli 14y ago
Article covers main parts of the webserver setup and gathers very interesting information scattered all over the Internet. All the nginx setup and config things are REALLY useful, all the more regarding the poor quantity/quality of resources one can find out there. Really useful to me. I wish I had one guide like this when I setup my own webserver. I made a tl;dr version but the main interesting parts stay all the nginx tricks for me http://tldr.io/tldrs/50b5ccb711c0ea5051000f29 http://tldr.io/tldrs/50b5ccb711c0ea5051000f29.
edtechdev 14y ago
This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc. If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts http://lowendscripts.com/wiki/shell_scripts I personally used a fork of lowendscript last year to set up some servers, but if I had to set up a new server today, I'd check out some of the other other options at that link, like Minstall: https://github.com/maxexcloo/Minstall https://github.com/maxexcloo/Minstall But this Xeoncross lowendscript fork is still very active: https://github.com/Xeoncross/lowendscript https://github.com/Xeoncross/lowendscript
- antihero 14y ago
  Fail2ban is actually a vulnerability in itself. Say I worked out your home IP (not hard), then sent a large number of failed SSH attempts with the IP address forged as yours. You are now locked out if your home server.
  - jiggy2011 14y ago
    True, but then they would have to know your home IP number which the login-spam bots won't. I always make sure I have some access to a network KVM or remote console for my servers so I would be able to unblock myself.
  - jackalope 14y ago
    That's why I whitelist my IPs in $ignoreip in jail.conf. Fail2ban is actually a vulnerability in itself. That's a bit harsh. It's true that you may have to tweak some settings to prevent or minimize DoS attacks, but even that risk is a far cry from an attacker gaining a login or rooting the box. Fail2ban has proven to be safe and reliable in the years I've used it. Nonetheless, the old maxim holds true: Know your tools.
    - e12e 14y ago
      That's why I whitelist my IPs in $ignoreip in jail.conf. If you are already able to whitelist your (valid) login points, why would you need fail2ban? Just whilteliste them in your firewall and/or /etc/hosts.allow. Personally I've yet had anyone bruteforce my ssh-key (although, as I run Debian, that is just luck as it turned out...). Still, fail2ban wouldn't really have helped against an attacker that knows/can figure out my access token off line...
patrickg 14y ago
What kind of 'top' program is this shown in page 3 (direkt link to the image: http://cdn.arstechnica.net/wp-content/uploads/2012/11/webserver-workerprocesses.jpg http://cdn.arstechnica.net/wp-content/uploads/2012/11/webser...)
- nazgul5 14y ago
  http://htop.sourceforge.net/ http://htop.sourceforge.net/
  - patrickg 14y ago
    Thanks. Installed.
- wolf550e 14y ago
  http://htop.sourceforge.net/ http://htop.sourceforge.net/
jimfuller 14y ago
nice introduction article (on mostly how to setup nginx); the title should reflect this instead of focusing on 'safe and secure' ... if one was to store something valuable (lets say cc info) you would want to go far beyond what this article covers. #justsayin
antihero 14y ago
Is there really any benefit to using nginx over Apache 2.4 (Event MPM)?
- deleted 14y ago
  [deleted]
mrcrassic 14y ago
Personally, I'd just pay $10/month or whatever and spin up a cheap VM on Rackspace, EC2 or similar with 256MB of RAM and a few gigs of disk storage. A simple web server really doesn't need a full on server (or desktop, even). It's a bit different if you're expecting said site to get 100K+ views per day or is going to host some big database, but even then I'd probably run it in the cloud to save on bandwidth costs.
0ren 14y ago
Nitpick: > Temporary files usually start with a dot or a dollar-sign.. to make sure that Nginx never serves any files starting with either of those characters... > location ~ ~$ { access_log off; log_not_found off; deny all; } Wouldn't that regex match temporary files ending with ~ (as it should)?
madaxe 14y ago
The only way to make a server 100% secure is to grind it into dust and fire it into a black hole.

345 points by chinmoy 14y ago

jiggy2011 14y ago

It's also a good idea to install (and configure) at least some basic IDS like tripwire. You should probably have it do checks on a cron job as well as doing chkrootkit. Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them. Also if you have multiple web apps running, chroot them if at all possible so that if something does break out it can't (so easily) wreak havok over your entire filesystem. If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily. I also didn't see mention of an update strategy for security updates. You can use apticron to email you with which updates are available and which are important for security. You can set updates to go automatically (I recommend security only) but if you are more cautious you might want to test on a VM first. But keep an eye on them! This is very important, especially if you are managing wordpress etc through apt. And so many other things that I have probably forgotten. Having some form of audit (that tripwire can provide) is vital in those "oh fuck" moments where something doesn't seem quite right and you start wondering if you have been pwned but have no real way of actually knowing.

colonelxc 14y ago
> If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily. I'm slightly confused by this, within the context of this article. Yes, /tmp is readable and writable by all, but that doesn't mean that everything in it is readable or writable to other people. The sessions that PHP creates will be owned by the webserver user (nobody/www-data/something else), and shouldn't be readable or writable by other users. This is still a problem with shared hosting, where you might have multiple websites running on the same server. One shared host would be able to read another's sessions, because they are all running under the webserver's user. This[1] suggests overriding the session_set_save_handler and writing to a resource that only you control, such as your DB. [1] http://phpsec.org/projects/guide/5.html http://phpsec.org/projects/guide/5.html
- jiggy2011 14y ago
  Yes, that's precisely what I meant. I shouldn't post when I'm tired :)
spindritf 14y ago
> You should probably have it do checks on a cron job as well as doing chkrootkit. http://securityreactions.tumblr.com/post/36736148501/rkhunter-1-2-5-running-every-night-as-the-cron-job http://securityreactions.tumblr.com/post/36736148501/rkhunte... I know it's a meme-grade blog but it really fits.

JoeCortopassi 14y ago

For anyone that wants more resources like this, I've found articles in Linode's library to be very helpful: http://library.linode.com/lamp-guides http://library.linode.com/lamp-guides

therealarmen 14y ago
I live (and die) be these guides.
- circa 14y ago
  haha! yes me too. so great!
WickyNilliams 14y ago
Thanks so much for these links. Got a server coming for Christmas (best present evah!!1!) and was worried that I'd get completely lost trying to configure it blindly. Will definitely refer back to these on that jolliest of days

leadholder 14y ago

I recently worked on a site run on such a server. I've set up my own servers before, and I think it can be fun, but this time it was the other guy's. I have to say it was pretty annoying because the little things that were not set up properly added up to a website that wouldn't deliver email, a shell environment with awful defaults...yuck. There was a lot of maintenance that was ignored because the guy just didn't have the time. Well, that's what commercial web hosts are for. It's amusing to think that some overburdened IT guys believe they're doing their clients a huge favor by running a vanilla web server in their network closet.

deleted 14y ago

[deleted]

jkuria 14y ago

Frankly, articles like these are a deterrent to all but the most techie of people. Why go through all this and shell $270 when you can get an Amazon EC2 instance free for a year!

chewxy 14y ago
Did you read the article? You still need to setup nginx or apache or whatever on EC2. Page 2 onwards actually deals with these things
- pan69 14y ago
  Yeah. So why pay $270?
  - rburhum 14y ago
    Perhaps you need storage in terabytes for something. 12TB on your own machine is relatively cheap. On AWS, not so much. Read speed is another factor.
Stealth- 14y ago
As far as being "the most techie of people", this article is actually quite basic and gives a very easy introduction.
thedufer 14y ago
Honestly, its a much easier setup on your own box. You have the option of a GUI, and I've found installing a linux distro on my own box to be much easier than figuring out EC2.
- BigRedS 14y ago
  I'm not sure where a GUI comes in handy here - it's not like there's any good GUI (in the traditional sense) tools for fiddling with webserver config. Even were I to want one on a webserver on the localhost I'd probably just install webmin or something, which you can do equally well on a VM somewhere else.

quandrum 14y ago

I think it's time articles like these start suggesting an infrastructure as code product, like chef or puppet, to do the heavy lifting. I feel like doing this stuff by hand should be considered insecure and outdated..

mrkurt 14y ago
All chef and puppet give you is a tool to setup 100 insecure and outdated servers, they don't help at all with the initial security decisions.
EricDeb 14y ago
Any other tools or resources you'd recommend to a newbie web server admin? I've checked out a few books but it's hard to know what's being used in industry.
- buster 14y ago
  I'd recommend puppet or ansible. http://ansible.cc/ http://ansible.cc/ http://puppetlabs.com/ http://puppetlabs.com/
calpaterson 14y ago
If you don't know how to do it by hand, then puppet is just going to confuse you. Better to keep it simple when you're new at something.

hardik988 14y ago

Pardon my stupidity, but how would one go about getting an IP address for a server installed at home? Is it a static IP address provided by my ISP, or something else ?

ceol 14y ago
If you have a dynamic IP, Dyn offers DNS services[0] that let you tie a domain to it through them. I believe it requires you to install something on your machine that monitors your IP and reports it back. Otherwise, you just use your IP and make sure to edit the DNS yourself when it changes. [0]: http://dyn.com/dns/ http://dyn.com/dns/
- kysol 14y ago
  That would be something like: http://dyn.com/support/clients/linux/ddclient/ http://dyn.com/support/clients/linux/ddclient/
- Stratoscope 14y ago
  Many routers have dynamic DNS support built in now. For example, my Asus RT-N66U supports several DDNS services including Dyn and a free one that Asus provides for its router customers at {yourcustomsubdomain}.asuscomm.com. No big surprise here, since the router is really just a nice little Linux box.
  - ceol 14y ago
    Ah, I have an Asus RT-N16. DD-WRT is truly awesome!
stephen_g 14y ago
By your ISP. Some plans come with a static IP by default, but many providers make you pay extra (or go onto a business plan if you tell them you want to run servers)
politician 14y ago
The messages that your computer sends to the internet include an IP address which the internet uses to send responses back to your computer. The problem is that these addresses are unstable -- your ISP reserves the right to change it, basically. If you want to host a server from home, you have a few choices: a) Obtain a static IP address from your ISP. b) Obtain a domain name from a dynamic DNS provider and map that to your current IP address. Update the mapping as necessary. c) Just use your existing IP address -- this is how P2P or Skype works, for example.

zdw 14y ago

Better hardware would be an HP Microserver (which should win the contest for "worst URL ever"): http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-4237916-4237918-4237917-4248009.html?dnr=1 http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15351-15351-42... Has ECC RAM support. Takes 4 3.5" hard disks, and runs very quiet and cool.

da_n 14y ago
That is a truly frightening URL, makes me wonder what kind of CMS they are running that generates 100 character long URI (Vignette?).
- thejosh 14y ago
  The HP Blog URLs are scary as well..
- pooriaazimi 14y ago
  This is the scary part IMO: http://h10010.www1.hp.com http://h10010.www1.hp.com - If you go to http://www.hp.com/xxxxxx http://www.hp.com/xxxxxx (the rest) or even http://h10010.www.hp.com/xxxxx http://h10010.www.hp.com/xxxxx, it's a 404. Even worse: curl http://www1.hp.com curl: (6) Could not resolve host: www1.hp.com; nodename nor servname provided, or not known
sliverstorm 14y ago
I looked at getting one of those. However, it seems like HP is sunsetting the Microserver line, which is a real shame.
- kryptiskt 14y ago
  Which is a good reason to get one now. I have one (running FreeBSD and ZFS), and it has been great. I does what I ask of a homeserver: it runs silently and is pretty good at saturating a 1Gb connection, the RAM really helps the performance. All at a great price.
  - 14y ago

barefoot 14y ago

"...being locked to IIS as a Web server (or dependent on crippled Windows ports of better Web servers) means you'll be playing in the bush leagues. IIS is found running many huge and powerful websites in the world, but it's rarely selected in a vacuum..." I sense a little bit of bias. As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is a first class framework and many prefer it over other popular alternatives on other platforms such as Django, Rails, and Cake. In addition, Visual Studio is arguably the best IDE available and publishing to an IIS server is dead simple. As for cost, full versions of Visual Studio and Windows Server can both be obtained for free through the DreamSpark program for college students and through the similar BizSpark program for startups and small businesses.

stephen_g 14y ago
Do those versions let you use the products on production web servers though?
- sliverstorm 14y ago
  Isn't that what "full versions" means?
  - Pwnguinz 14y ago
    Not sure if you're being sarcastic or not, but "no". Whether or not a particular software can be used in a commercial context has more to do with licensing than how "full version" it is. In fact, even Trial versions of softwares can often be used in a commercial context during the trial period. Versus, say, the full version of VMware Player, which while full featured and having no trial period, is prohibited via license to be used commercially.
- Encosia 14y ago
  Yes.
hristov 14y ago
I tried to read the Bizspark FAQ, and now my head hurts. But anyways, what I think I was able to get out of it is that: 1. You have to apply. 2. You have to be approved, which takes a minimum of 5 business days, and you may not get approved. 3. At some point you "graduate" and lose your licenses and have to pay for software. The faq does not say when this graduation happens, but I seem to remember hearing something about 6 months. So, no it is not really free. And it is definitely harder to get it than simply typing: sudo apt-get install apache2

leeoniya 14y ago

knockd + fail2ban + iptables http://howto.biapy.com/en/debian-gnu-linux/system/security/harden-the-ssh-access-security-on-debian http://howto.biapy.com/en/debian-gnu-linux/system/security/h... also, chrooted sftp-only accounts http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP#Chrooted_SFTP-only_Accounts http://en.wikibooks.org/wiki/OpenSSH/Cookbook/SFTP#Chrooted_...

shy_coder 14y ago
http://configserver.com/cp/csf.html http://configserver.com/cp/csf.html Another solution that is much easier to configure compared to iptables/fail2ban.

buster 14y ago

Ah well, it's rather a "how i set up a small web server for fiddling around with stuff" not so much a professional article about security. Sorry, but the first page is like "mhh, yeah, geeks hate MS, let's use the other choices" under the hood. Why? Because it doesn't really mention a technical choice against MS. Don't get me wrong i would never ever use Windows Server but when i'd write such an article i'd have to find at least a few technical pros and cons for the choices i preset. "Uhhh, the internet is more like a unixy thing" doesn't cut it. This goes on with the choice for Ubuntu Server. Why? Is it an article about "safe and secure web server" or about "how does my grandma set up a server"? There are much more choices in terms of reliability and proven track record like FreeBSD, OpenBSD, Debian, RHEL/CentOS. The choice was made because it's easier to set up and apparently the author is too lazy to _really_ do his homework. In the end, i'd say if the articles title would be "beginners guide how to setup a server" i wouldn't comlain..

mylittlepony 14y ago
As a professional developer and amateur sysadmin, I have to say Ubuntu is a great choice, and I will never use CentOS again. The main reason being how updated packages are in Ubuntu, and outdated in CentOS. I don't know about the other options.
- buster 14y ago
  I would much more care for timely security updates. Servers are the parts where you don't need the latest software, in my opinion. Not if it comes for less stability or security. In the best case i have a very secure default installation, install the software i need from updated repositories, let the server update itself (or let it remind me of updates) and be gone with touching the shell ever again. The goal is to have the server running safe and secure for years and not to have the latest pre-beta release versions of NoSQL-engine XYZ "just because". Personally on my Desktop i have been a Debian guy (and after that Ubuntu), but it all depends on the requirements. My personal view: - my personal server runs Debian but i would place ubuntu a second for a one-person thing with no personal data on it. I know it runs a stable and updated OS and it just runs and runs and runs. You need a newer software version? You can selectively take some from testing or even unstable if you have to. You still get timely updates and live in an eco-system that is largely seen as proven, stable, excellent. Ubuntu (afaik) only get's Debian testing packages anyway, but still needs to patch them or tweak them. Or you get non-upstream packages. Also my experience is that Debians configuration is quite secure by default. Whereas Ubuntu tries to make it easy for you but also more open to security flaws. - for an enterprise i can totally see why many choose RHEL (because of support, fast security updates and great in-house know-how. Do you know how many kernel developers are employed by Ubuntu? You don't want to know.. I give a lot of Kudos to RedHat for being such an open and contributing company.) - for a start-up i can totally see how FreeBSD might fit as an internet-facing frontend. It's a stable and fast workhorse, and you'll end up compiling, configuring, installing the core components of your system all the time anyway. Talking about it i feel a bit sad of not mentioning Solaris anymore. Solaris "was" awesome.

hakaaak 14y ago

http://stackoverflow.com/questions/72394/what-should-a-developer-know-before-building-a-public-web-site http://stackoverflow.com/questions/72394/what-should-a-devel... can't believe that hasn't been on HN before, so added it: http://news.ycombinator.com/item?id=4841329 http://news.ycombinator.com/item?id=4841329

nimrody 14y ago
What is really amazing is that these sort of questions (and detailed answers) are not welcome on StackOverflow: Locked: "This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: FAQ." At least the list of references there is useful.

Jailout2000 14y ago

What a bias. Using Debian and not even mentioning forks like Red Hat. Downvoted, never recommend.

babarock 14y ago

Am I the only one who thinks that SSD are useless since most of the time the processing will be bottlenecked by the network overhead?

jbri 14y ago
Unless you're purely serving static content, network bandwidth is not going to be your bottleck. That's not really the point though, since the big motivator for SSDs isn't bandwidth, it's latency.
bad_user 14y ago
Network overhead is just one bottleneck. A harddisk seek + reading 1 MB sequentially is something like 30 times slower than SSD and 120 times slower than reading from RAM. Disk seeks are what really kills you, as a disk seek is 20 times slower than a roundtrip within the same datacenter. Sending 1 MB of data over a 1Gbps network using a disk seek and a sequential read is 3.6 times slower than doing the same with SSD. For big files with a server that has to serve many concurrent requests you'll end up doing several disk seeks for the same file. And we've been talking about the ideal too, because data on disks can get fragmented and so reading from the same file does not guarantee a sequential read. This is why Varnish does caching, even when serving static files. If you want high performance with low latency, then Varnish works better than something like Nginx. As an example, right now I'm working on integrating with an OpenRTB ads exchange platform. My server has to respond within 100ms total roundtrip (with an upper bound of 200ms, but they complain if you consistently respond in over 100ms). It's enough to say that everything to be served has to be already in memory, as doing anything else means that window cannot be met (consider how a single disk seek can cost something like 10ms). So yeah, SSDs can be useful.
- babarock 14y ago
  Thank you for the explanation.

dschiptsov 14y ago

Vurtualization is not for production. Why to have this useless layer, which messes up your CPU caches even more, interfere with you IO and complicates memory model? What for? Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages. Vistualization is not for production. Production servers need less code, not more. It is the same kind of mistake as JVM - we need less code, integrated with OS, not more "isolated" crapware which needs networking, AIO and really quick access to the code from shared libraries. And, of course, a setup without middle-ware (python-wsgi, etc) and several storage back-ends (redis, postgres) is meaningless. Update: Well, production is not about having a big server which is almost always 100% idle, and can be partitioned (with KVM, not a third-party product) to make a few semi-independent virtual servers 99% idle. This is virtual, imaginary advantage. On the other side, your network card and your storage system cannot be partitioned efficiently, despite all they say in commercials. And that VM migration is also nonsense. You are running, say, a MySQL instance. Can you migrate it without a shutdown and then taking a snapshot of an FS? No. So, what migration you're talking about? It is all about your data, not about having a copy of a disk-image. It is OK to partition development, or 100% idle machines - like almost all those Linode instances, which have a couple of page request in a day - this is what it was made for, same as old plain Apache virtual-hosting. But as long as one needs performance and low latency, all the middle-men must go away.

te_chris 14y ago
How is this the top comment? I'm sure some of your points may be salient, but practical experience says virtualization works just fine for production. Same with the JVM.
- dschiptsov 14y ago
  1. at what cost? 2. just fine is not enough. 3. for some reasons all sites uses nginx, not jetty.)
  - lemieux 14y ago
    Nginx and jetty are not the same thing. Nginx is a web server optimized to deliver content. Jetty is an application server built to run the applications. Both can be used together. Also...Is Amazon EC2 considered virtualization for you?

tzaman 14y ago

This article would make a really nice screencast that would be much more useful to newbie sysadmins.

e12e 14y ago
How would a screencast be more useful?
- drudru11 14y ago
  not sure, but I wanted to say thanks for the C as a functional language links you replied with earlier. Comments are off after 14 days so I couldn't say thank you there. The closest was the function pointer one, but it still wasn't the one I remember.
- tzaman 14y ago
  It's much easier to see the workflow and listen to someone speak, than read a complex article.
  - e12e 14y ago
    sounds like an argument for a simpler article. I agree, the article is rubbish.

rlpb 14y ago

If you want a safe and secure Web server, use what your distribution gives you. Don't add third party sources if you can avoid it, ie. don't need features < 1 year old. It's hardly safe and secure if it's not had long enough for people to find problems with it anyway. Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get all your updates in case fixes are needed. If you start adding third party sources, you're on your own as to managing any implications of the way you've put it together. Just because each individual component is safe and secure doesn't mean that it is as a whole. For example, Ubuntu add hardening (AppArmor) for various server daemons which you won't get if you just download apache from the project website. If you need a guide on putting a system together yourself, then you aren't someone who can manage these implications yourself, and you're trusting the guide author in not having made any mistakes. Are you really in a position to judge his competence? Just use your distribution's standard web server and you'll get your safe and secure Web server in one command.

laumars 14y ago
I disagree with that. Apache's defaults on most distros isn't secure. Even 'enterprise' level distributions often fall into the following traps when packaging Apache: 1-> auto indexing enabled (should be disabled) 2-> user directories enabled (should be disabled) 3-> server signatures 'on' (should be 'off') 4-> server tokens set to 'full' (should be 'prod') 5-> hidden (dot prefixed) files not always blacklisted as unauthorised files in Apache config 6-> same as above for editor specific back up files (eg file~). But this is only an issue for people who bulk upload or edit files on the live server (very naughty). 7-> having less optimal SSL configurations (Apache's default SSL set up isn't PCI compliant). (IIRC there's a couple of other Apache tweaks, but that's just off the top of my head) Then you have issues with PHP (eg logging to STDOUT so web users can view PHP errors). And that's just covering the webserver configuration. There's still holes that need plugging if you actually want to run a secure web server; one of my favourite tools for that is using fail2ban which will auto-blacklist IPs in iptables (Linux firewall) based on if certain attacks are detected. For example it can prevent brute force attacks on SSH brute force attacks (which negates the need to run denyhosts as recommended in the article), HTTP auth, FTP, mail servers, etc. And touching on SSH, many data centres will enable root log ins on their OS pre-installs by default. Your first job on any such box will be creating a user account and then disabling root log ins (PermitRootLogin no -> /etc/ssh/sshd_config). Then there's a whole stack of optimisations you can run on iptables to adaptively prevent port scanning, forged TCP/IP packets and such like. Also many distributions ship FTP, which is insecure by default. Anyone sys admin requiring FTP hosting would be better off using a chrooted SFTP environment (so the security benefits of SSH plus the sandboxed (chroot) environment that FTP often benefits). Let's also not forget the plethora of internal services (databases, MTAs (mail servers), etc). If you're reading this article then you're probably not a trained systems administrator or not working for a large enough company where each server is running in it's own environment. Thus your MySQL / Postgre / whatever databases are running on your webservers. So you need to ensure that your database is only listening on localhost (127.0.0.1). Same applied for your MTA, unless you are intentionally providing a mail services (it is advisable to have an MTA installed even if you're not providing mail services because you can then set up daemons like fail2ban to automatically e-mail you when attempted break ins happen; which will in turn allow you to spot any determined hackers and permanently ban their IP from your box). And lastly, if you're really paranoid, run your webserver inside a Linux/UNIX container (FreeBSD Jail, Solaris Zone, Linux OpenVZ) instead of inside a virtual machine as there have been hacks where attackers can break out of the VM and gain access to the host system (as of yet, I've not heard such attacks from containers, but if anyone has any evidence of that then I'd love to know). Running inside a container will give your webserver the sandboxed environment to work with plus an easy route for backups / snapshotting meaning minimal downtime and data loss should the worst happen and your server does become compromised. (source: http://www.youtube.com/watch?v=hCPFlwSCmvU http://www.youtube.com/watch?v=hCPFlwSCmvU - it's a plugged vulnerability, but it will give you an idea about the kind of issues VMs face when compared to containers) In short; distribution's don't ship secure defaults. They ship a happy medium between usability and security. However if you have an internet facing box (particularly one not hidden behind a hardware firewall, as many budget set ups are not), then the happy medium isn't secure enough.

Charlesmigli 14y ago

Article covers main parts of the webserver setup and gathers very interesting information scattered all over the Internet. All the nginx setup and config things are REALLY useful, all the more regarding the poor quantity/quality of resources one can find out there. Really useful to me. I wish I had one guide like this when I setup my own webserver. I made a tl;dr version but the main interesting parts stay all the nginx tricks for me http://tldr.io/tldrs/50b5ccb711c0ea5051000f29 http://tldr.io/tldrs/50b5ccb711c0ea5051000f29.

edtechdev 14y ago

This guide doesn't cover important things like the firewall and blocking attackers (shorewall, fail2ban) and properly configuring mysql, php, etc. If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly: http://lowendscripts.com/wiki/shell_scripts http://lowendscripts.com/wiki/shell_scripts I personally used a fork of lowendscript last year to set up some servers, but if I had to set up a new server today, I'd check out some of the other other options at that link, like Minstall: https://github.com/maxexcloo/Minstall https://github.com/maxexcloo/Minstall But this Xeoncross lowendscript fork is still very active: https://github.com/Xeoncross/lowendscript https://github.com/Xeoncross/lowendscript

antihero 14y ago
Fail2ban is actually a vulnerability in itself. Say I worked out your home IP (not hard), then sent a large number of failed SSH attempts with the IP address forged as yours. You are now locked out if your home server.
- jiggy2011 14y ago
  True, but then they would have to know your home IP number which the login-spam bots won't. I always make sure I have some access to a network KVM or remote console for my servers so I would be able to unblock myself.
- jackalope 14y ago
  That's why I whitelist my IPs in $ignoreip in jail.conf. Fail2ban is actually a vulnerability in itself. That's a bit harsh. It's true that you may have to tweak some settings to prevent or minimize DoS attacks, but even that risk is a far cry from an attacker gaining a login or rooting the box. Fail2ban has proven to be safe and reliable in the years I've used it. Nonetheless, the old maxim holds true: Know your tools.
  - e12e 14y ago
    That's why I whitelist my IPs in $ignoreip in jail.conf. If you are already able to whitelist your (valid) login points, why would you need fail2ban? Just whilteliste them in your firewall and/or /etc/hosts.allow. Personally I've yet had anyone bruteforce my ssh-key (although, as I run Debian, that is just luck as it turned out...). Still, fail2ban wouldn't really have helped against an attacker that knows/can figure out my access token off line...

patrickg 14y ago

What kind of 'top' program is this shown in page 3 (direkt link to the image: http://cdn.arstechnica.net/wp-content/uploads/2012/11/webserver-workerprocesses.jpg http://cdn.arstechnica.net/wp-content/uploads/2012/11/webser...)

nazgul5 14y ago
http://htop.sourceforge.net/ http://htop.sourceforge.net/
- patrickg 14y ago
  Thanks. Installed.
wolf550e 14y ago
http://htop.sourceforge.net/ http://htop.sourceforge.net/

jimfuller 14y ago

nice introduction article (on mostly how to setup nginx); the title should reflect this instead of focusing on 'safe and secure' ... if one was to store something valuable (lets say cc info) you would want to go far beyond what this article covers. #justsayin

antihero 14y ago

Is there really any benefit to using nginx over Apache 2.4 (Event MPM)?

deleted 14y ago
[deleted]

mrcrassic 14y ago

Personally, I'd just pay $10/month or whatever and spin up a cheap VM on Rackspace, EC2 or similar with 256MB of RAM and a few gigs of disk storage. A simple web server really doesn't need a full on server (or desktop, even). It's a bit different if you're expecting said site to get 100K+ views per day or is going to host some big database, but even then I'd probably run it in the cloud to save on bandwidth costs.

0ren 14y ago

Nitpick: > Temporary files usually start with a dot or a dollar-sign.. to make sure that Nginx never serves any files starting with either of those characters... > location ~ ~$ { access_log off; log_not_found off; deny all; } Wouldn't that regex match temporary files ending with ~ (as it should)?

madaxe 14y ago

The only way to make a server 100% secure is to grind it into dust and fire it into a black hole.