I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are :
- List item
- update all packages
- remove all unnecessary services like named, portmap, lwresd...
- add a startup iptables script : block everything except 22 and 80 inside and allow all outside. Force SYN packets check, force fragments packets check, drop XMAS packets, drop Drop all NULL packets, drop local ip on wan, all only icmp type 0 and 8.
- SSH : remove root login and password authentication. Use keys instead. Allow only the valid username. Protocol 2 only
- PHP : expose_php=Off, limit php modules to used one's, don't display errors to the visitor : display_errors=Off and log_errors=On, allow_url_fopen=Off, allow_url_include=Off and remove dangerous functions
- Apache : ServerSignature Off, ServerTokens Prod
- Install additional package : fail2ban (ssh bruteforce protection), chkrootkit (rootkit detection), logwatch (day to day log care), munin (ressource monitoring), apticron (watch for new update)
Do you see something else ?