5 ms·

How, or where, does one learn how to implement a secure application (say, nginx + uwsgi + python + mongodb)? This is a serious question - the best that I'm awa

• deleted 13y ago
  [deleted]
• theboss 13y ago
  things like nginx and apache are quite secure out of the box. There are three or four main things you need to do for your architecture though. 1) Change default passwords. You might be surprised how often I am able to get in with root toor or root no password. Mysql? Remember to change the root password (because there is none by default) 2) Learn OWASP top 10 and write good code. They have code RIGHT ON THE SITE for how to write a better more secure web-app. There aren't a whole lot of sites out there that make it hard to break their web-app 3)Keep your stuff updated. There was a apache php 0day today. You better believe everyone needs to update their services. 4) Disable extra services you don't need. Telnet, FTP, 53, 445, the list is long depending on what you're running. IF you don't need it, disable it. Don't set a firewall in front of it and call it secure, disable it. To top it off. 5) 2 factor your ssh (and make sure you're using ssh2 always.) if you don't have a VPN set up. Make it so an attacker needs the key and your password. If you do this minimal stuff you should be fairly secure. edit: Securing particular services takes a lot of experience and knowledge about the service. nginx, apache, etc. To do special things to it you need expertise. This is why out of the box, nginx and apache run with low privileges and are fairly secure.