Security for home server, wiki

Question

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, and other relevant information. Currently, access is limited to my LAN, essentially prohibiting outside access, but I'm considering allowing external access, if I can figure out how to meet a level of security. Specifically, I'm looking for a solution which:

1. Prevents read access of any web content without some kind of authentication.
2. The authentication should be passed in such a way to prevent packet sniffing to allow permanent access to the network.
3. Ideally, I don't want this to cost anything, or if it costs something, to be a small one time cost.
4. As one of the most common locations I will be accessing this will be work, I would prefer a solution which does not require any additional software on the client end.
5. Access to within the LAN must be unrestricted, ie, no password required.
6. I would like to be able to access the site occasionally from my Android phone, so any solution should not prevent that from working.
7. I would like to expand this someday to allow more than just wiki software, but if there's a clever way to do this with the wiki software, I'll consider it.

My current thought is leaning towards producing a self-signed SSL certificate, and using apache authentication, either basic or digest, but requiring it to be passed over HTTPS, but I'm opened to alternative solutions.

My full config:

• Ubuntu 11.10
• Apache 2.2
• Media Wiki 1.18

Answer 1

Jeff's comment gets it right. Producing an SSL certificate is necessary. If you have a domain name registered, you could skip the self-signed and go with a free SSL certificate so every new web browser you try will not complain about the certificate being untrusted (reducing the likelihood of MITM attacks). If you don't have a domain name, you can use openssl to create your own self signed certificate.

This allows you to login to your computer over HTTPS.

Next you'll probably want to add apache authentication along with exceptions for the local LAN block (192.168.0.0/16 or whatever). This can be done with a simple set of rules defined at: http://httpd.apache.org/docs/2.0/howto/auth.html

Answer 2

How to secure a web server by the use of transport encryption has been answered already. But I would like to point out, that from what you wrote I would guess that you are still not aware about the major security concern for your installation. This is the list of security problems of PHP of the last two years:

• CVE-2010-0397
• CVE-2010-1128
• CVE-2010-1129
• CVE-2010-1130
• CVE-2010-1860
• CVE-2010-1862
• CVE-2010-1864
• CVE-2010-2097
• CVE-2010-2100
• CVE-2010-2101
• CVE-2010-2190
• CVE-2010-2191
• CVE-2010-2225
• CVE-2010-2484
• CVE-2010-2531
• CVE-2010-3065
• CVE-2010-3436
• CVE-2010-3709
• CVE-2010-4150
• CVE-2010-4645
• CVE-2010-4697
• CVE-2010-4698
• CVE-2011-0421
• CVE-2011-0708
• CVE-2011-0752
• CVE-2011-1092
• CVE-2011-1148
• CVE-2011-1153
• CVE-2011-1938
• CVE-2011-2202
• CVE-2011-2483
• CVE-2011-4566
• CVE-2011-4885
• CVE-2012-0830

As you can see the major problem is neither Apache nor MediaWiki but PHP.

I would never expose my private data with PHP to the public. I would suggest as a minimum requirement preventing any unauthorized access to the site from the public. Furthermore I would suggest the use of a client certificate and prevent any other access. This can be done with the SSLRequire directive of Apache. See the Strong Encryption Howto for further information.