Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Obvious things:

  1. Disable root login (rather, don't enable it)
  2. Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
  3. IP Tables firewall whitelisting only the proper traffic on 80/443/22
  4. Update all packages
  5. Disable Control-Alt-Delete for the console

The OS is Ubuntu 12.04.1 x86-64 (server) and the use is as a web application server. The software used is:

  1. Nginx (run as www-data)
  2. Supervisor (run as root with no HTTP server or RPC server)
  3. uWSGI (run as www-data)
  4. Celery (run as www-data)
  5. Redis (run as www-data)
  6. Memcached (run as www-data)

I ask because I'm not sure what things that are installed with Ubuntu 12.04.1 which might be have potential security vulnerabilities, which things I may have accidentally left off my "obvious" checklist and which of the packages I've mentioned above which might have security vulnerabilities (all installed as packages vs manually compiling, btw).

share|improve this question
    
Might add some SYN packet rate limiting on the IPTables firewall too, it won't stop a DDoS attack, but it it can help weather the effects. –  ewanm89 Dec 7 '12 at 19:06
    
Was it ubuntu server edition installed? Not desktop edition stripped? –  ewanm89 Dec 7 '12 at 19:08
    
@ewanm89 - yeah, server edition. Thanks btw (for the tip on SYN packet rate limiting). –  orokusaki Dec 7 '12 at 19:45
    
total and complete disregard for application separation. –  Rook Dec 7 '12 at 20:05
add comment

1 Answer

up vote 1 down vote accepted
  • Run your web application as a different user than everyone else. This is what www-data is for!!!!!
  • Remove write access to your web root! (And only your web application (www-data) should have read/execute)
  • Use a Web Application Firewall (WAF). Naxsi for Nginx is an option however mod_security is a better WAF.
  • Remove access to port 22 using Port Knocking Or Bastion Host (Bonus points for using both!)
  • Force HTTPS only to avoid OWASP a9 violations. HTTP should only be used to set HSTS and redirects to HTTPS.
  • Last I checked Ubuntu doesn't have AppArmor rule sets for ngix, where as they do for the LAMP install. Also be aware that nginx is very young and as a result more advisories are released for ngix than [Apache]
  • setup apt autoupdate for security related updates.
  • If you have the money, get a pentest
share|improve this answer
    
Thanks - regarding your "total and complete disregard..." comment: Did you mean, because I've used www-data so gratuitously? Which programs should be running as www-data? My web application is really a combination of uWSGI and Nginx. Should both run as www-data? –  orokusaki Dec 7 '12 at 20:30
1  
@orokusaki Ok, you probably have never written an exploit. But the best exploits are using the services against each other. For instance using the database to write a .php file in the web root. AppArmor helps with this, but your using ngix and everyone is running as www-data so you absolutely no separation what so ever. You just threw a bunch of criminals with construction equipment in the same jail cell. –  Rook Dec 7 '12 at 20:36
    
Thanks Rook. That's good info to have. I did typo when I said Memcached and Redis would run as www-data, but the rest were www-data :( lesson learned the easy way though :) –  orokusaki Dec 7 '12 at 21:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.